CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2018-16599
https://notcve.org/view.php?id=CVE-2018-16599
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of NBNS packets in prvTreatNBNS can be used for information disclosure. Se ha descubierto un problema en Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1, FreeRTOS hasta V10.0.1 (con FreeRTOS+TCP) y el componente middleware TCP/IP WITTENSTEIN WHIS Connect. El acceso fuera de límites a la memoria durante el análisis de paquetes NBNS en prvTreatNBNS se puede emplear para divulgar información. • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2018-16600
https://notcve.org/view.php?id=CVE-2018-16600
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of ARP packets in eARPProcessPacket can be used for information disclosure. Se ha descubierto un problema en Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1, FreeRTOS hasta V10.0.1 (con FreeRTOS+TCP) y el componente middleware TCP/IP WITTENSTEIN WHIS Connect. El acceso fuera de límites a la memoria durante el análisis de paquetes ARP en eARPProcessPacket se puede emplear para divulgar información. • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 3%CPEs: 2EXPL: 1CVE-2018-16525
https://notcve.org/view.php?id=CVE-2018-16525
Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow remote attackers to execute arbitrary code or leak information because of a Buffer Overflow during parsing of DNS\LLMNR packets in prvParseDNSReply. Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1, FreeRTOS hasta V10.0.1 (con FreeRTOS+TCP) y el componente middleware TCP/IP WITTENSTEIN WHIS Connect permiten que atacantes remotos ejecuten código arbitrario o filtren información debido a un desbordamiento de búfer durante el análisis de los paquetes DNS\LLMNR en prvParseDNSReply. • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md •
CVSS: 8.1EPSS: 3%CPEs: 2EXPL: 1CVE-2018-16526
https://notcve.org/view.php?id=CVE-2018-16526
Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow remote attackers to leak information or execute arbitrary code because of a Buffer Overflow during generation of a protocol checksum in usGenerateProtocolChecksum and prvProcessIPPacket. Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1, FreeRTOS hasta V10.0.1 (con FreeRTOS+TCP) y el componente middleware TCP/IP WITTENSTEIN WHIS Connect permiten que atacantes remotos filtren información o ejecuten código arbitrario debido a un desbordamiento de búfer durante la generación de una suma de verificación del protocolo en usGenerateProtocolChecksum y prvProcessIPPacket. • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19189
https://notcve.org/view.php?id=CVE-2018-19189
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php echo statement. El SDK de pasarela de pagos payfort-php-SDK de Amazon PAYFORT hasta el 26/04/2018 tiene Cross-Site Scripting (XSS) mediante un nombre de parámetro o valor arbitrario que se gestiona de manera incorrecta en una instrucción eco error.php. • http://www.securityfocus.com/bid/105930 https://www.seekurity.com/blog/general/payfort-multiple-security-issues-and-concerns-in-a-supposed-to-be-pci-dss-compliant-payment-processor-sdk • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •