CVE-2021-27435

ARM mbed Integer Overflow or Wraparound

ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.

CVSS 3.1 · 7.3 High EPSS 1.9% KEV · Not listed

Vendors

Arm

Products

Mbed

CVE-2021-27431

ARM CMSIS RTOS2 Integer Overflow or Wraparound

ARM CMSIS RTOS2 versions prior to 2.1.3 are vulnerable to integer wrap-around inosRtxMemoryAlloc (local malloc equivalent) function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or injected code execution.

CVSS 3.1 · 7.3 High EPSS 1.1% KEV · Not listed

Vendors

Arm

Products

Cmsis-rtos

CVE-2021-27421

NXP MCUXpresso SDK Integer Overflow or Wraparound

NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Nxp

Products

Mcuxpresso Software Development Kit

CVE-2021-22680

NXP MQX Integer Overflow or Wraparound

NXP MQX Versions 5.1 and prior are vulnerable to integer overflow in mem_alloc, _lwmem_alloc and _partition functions. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.

CVSS 3.1 · 7.3 High EPSS 1.6% KEV · Not listed

Vendors

Nxp

Products

Mqx

CVE-2021-27439

TencentOS-tiny Integer Overflow or Wraparound

TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory allocation size. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.

CVSS 3.1 · 7.3 High EPSS 1.6% KEV · Not listed

Vendors

Tencent

Products

Tencentos-tiny

CVE-2021-27433

ARM mbed-ualloc memory library Integer Overflow or Wraparound

ARM mbed-ualloc memory library version 1.3.0 is vulnerable to integer wrap-around in function mbed_krbs, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.

CVSS 3.1 · 7.3 High EPSS 1.8% KEV · Not listed

Vendors

Arm

Products

Mbed Ualloc

CVE-2021-38439

GurumDDS Heap-based Buffer Overflow

All versions of GurumDDS are vulnerable to heap-based buffer overflow, which may cause a denial-of-service condition or remotely execute arbitrary code.

CVSS 3.1 · 8.6 High EPSS 2.8% KEV · Not listed

Vendors

Gurum

Products

Gurumdds

CVE-2021-38441

Eclipse CycloneDDS Write-what-where Condition

Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser.

CVSS 3.1 · 6.6 Medium EPSS 2.1% KEV · Not listed

Vendors

Eclipse

Products

Cyclonedds

CVE-2021-38443

Eclipse CycloneDDS Improper Handling of Syntactically Invalid Structure

Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser.

CVSS 3.1 · 6.6 Medium EPSS 2.1% KEV · Not listed

Vendors

Eclipse

Products

Cyclonedds

CVE-2021-38445

OCI OpenDDS Secure Improper Handling of Length Parameter Inconsistency

OCI OpenDDS versions prior to 3.18.1 do not handle a length parameter consistent with the actual length of the associated data, which may allow an attacker to remotely execute arbitrary code.

CVSS 3.1 · 7 High EPSS 2.7% KEV · Not listed

Vendors

Objectcomputing

Products

Opendds

CVE-2021-38447

OCI OpenDDS Secure Amplification

OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, which may result in a denial-of-service condition.

CVSS 3.1 · 8.6 High EPSS 2.1% KEV · Not listed

Vendors

Objectcomputing

Products

Opendds

CVE-2021-43547

TwinOaks Computing CoreDX DDS Secure Network Amplification

TwinOaks Computing CoreDX DDS versions prior to 5.9.1 are susceptible to exploitation when an attacker sends a specially crafted packet to flood target devices with unwanted traffic. This may result in a denial-of-service condition and information exposure.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Twinoakscomputing

Products

Coredx Dds

CVE-2021-38423

GurumDDS Heap-based Incorrect Calculation of Buffer Size

All versions of GurumDDS improperly calculate the size to be used when allocating the buffer, which may result in a buffer overflow.

CVSS 3.1 · 6.6 Medium EPSS 1.3% KEV · Not listed

Vendors

Gurum

Products

Gurumdds

CVE-2021-38425

eProsima Fast DDS Network Amplification

eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure.

CVSS 3.1 · 7.5 High EPSS 5.0% KEV · Not listed

Vendors

Eprosima

Products

Fast Dds

CVE-2021-38427

RTI Connext DDS Professional and Connext DDS Secure Stack-based Buffer Overflow

RTI Connext DDS Professional and Connext DDS Secure Versions 4.2.x to 6.1.0 are vulnerable to a stack-based buffer overflow, which may allow a local attacker to execute arbitrary code.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Rti

Products

Connext Professional Connext Secure

CVE-2021-38429

OCI OpenDDS Secure Network Amplification

OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, which may result in a denial-of-service condition and information exposure.

CVSS 3.1 · 6.6 Medium EPSS 1.5% KEV · Not listed

Vendors

Objectcomputing

Products

Opendds

CVE-2021-38433

RTI Connext DDS Professional and Connext DDS Secure Stack-based Buffer Overflow

RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 vulnerable to a stack-based buffer overflow, which may allow a local attacker to execute arbitrary code.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Rti

Products

Connext Professional Connext Secure

CVE-2021-38435

RTI Connext DDS Professional and Connext DDS Secure Incorrect Calculation of Buffer Size

RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, which may result in a buffer overflow.

CVSS 3.1 · 6.6 Medium EPSS 1.4% KEV · Not listed

Vendors

Rti

Products

Connext Professional Connext Secure

CVE-2021-27478

EIPStackGroup OpENer Ethernet/IP Incorrect Conversion between Numeric Types

A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may cause a denial-of-service condition.

CVSS 3.1 · 8.2 High EPSS 1.1% KEV · Not listed

Vendors

Opener Project

Products

Opener

CVE-2021-27482

EIPStackGroup OpENer Ethernet/IP Out-of-bounds Read

A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may allow the attacker to read arbitrary data.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Opener Project

Products

Opener