The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfilteredhtml has been disabled.
The function dnscopyqname in dnspack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.
A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.
A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.
When the Global Pointer (GP) relative addressing is enabled (CONFIGRISCVGP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
No proper validation of the length of user input in olcpindhandler in zephyr/subsys/bluetooth/services/ots/otsclient.c.
In utf8trunc in zephyr/lib/utils/utf8.c, lastbytep can point to one byte before the string pointer if the string is empty.
In ascscprspadd in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.
BT:Classic: Multiple missing buf length checks
The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the updateuseraccess() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves full access to the plugin's settings.
A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
An malicious BLE device can crash BLE victim device by sending malformed gatt packet
Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.
Possible buffer overflow in ismountpoint
can: out of bounds in removerxfilter function
Signed to unsigned conversion esp32ipmsend
Unchecked length coming from user input in settings shell
Possible variant of CVE-2021-3434 in function leecredreconfreq.
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hcicore.c
Unchecked user input length in /subsys/net/l2/wifi/wifishell.c can cause buffer overflows.
Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver
The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIGCANAUTOBUSOFFRECOVERY=y. This results in calling ksleep() in IRQ context, causing a fatal exception.
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem
Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.
Possible buffer overflow in Zephyr mgmt subsystem when asserts are disabled
Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.