Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities by Zephyr
CVE-2022-3333 (GCVE-0-2022-3333)
Vulnerability from nvd – Published: 2022-09-28 04:35 – Updated: 2025-04-15 13:46
VLAI
EPSS
VEX
Title
Zephyr Project Manager REST Call cross site scripting
Summary
A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.2.5 is able to address this issue. It is recommended to upgrade the affected component. VDB-209370 is the identifier assigned to this vulnerability.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-707 - Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/bfd8a7aa-5977-4f… | x_refsource_MISC |
| https://vuldb.com/?id.209370 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zephyr | Project Manager |
Affected:
3.2.0
Affected: 3.2.1 Affected: 3.2.2 Affected: 3.2.3 Affected: 3.2.4 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:07:06.457Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/bfd8a7aa-5977-4fe5-b2fc-12bf93caf3ed"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.209370"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3333",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T16:59:51.951219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T13:46:47.321Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Project Manager",
"vendor": "Zephyr",
"versions": [
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.2.1"
},
{
"status": "affected",
"version": "3.2.2"
},
{
"status": "affected",
"version": "3.2.3"
},
{
"status": "affected",
"version": "3.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.2.5 is able to address this issue. It is recommended to upgrade the affected component. VDB-209370 is the identifier assigned to this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-707",
"description": "CWE-707 Improper Neutralization -\u003e CWE-74 Injection -\u003e CWE-79 Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-28T04:35:12.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/bfd8a7aa-5977-4fe5-b2fc-12bf93caf3ed"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.209370"
}
],
"title": "Zephyr Project Manager REST Call cross site scripting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2022-3333",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "Zephyr Project Manager REST Call cross site scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Project Manager",
"version": {
"version_data": [
{
"version_value": "3.2.0"
},
{
"version_value": "3.2.1"
},
{
"version_value": "3.2.2"
},
{
"version_value": "3.2.3"
},
{
"version_value": "3.2.4"
}
]
}
}
]
},
"vendor_name": "Zephyr"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.2.5 is able to address this issue. It is recommended to upgrade the affected component. VDB-209370 is the identifier assigned to this vulnerability."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-707 Improper Neutralization -\u003e CWE-74 Injection -\u003e CWE-79 Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/bfd8a7aa-5977-4fe5-b2fc-12bf93caf3ed",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/bfd8a7aa-5977-4fe5-b2fc-12bf93caf3ed"
},
{
"name": "https://vuldb.com/?id.209370",
"refsource": "MISC",
"url": "https://vuldb.com/?id.209370"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2022-3333",
"datePublished": "2022-09-28T04:35:12.000Z",
"dateReserved": "2022-09-27T00:00:00.000Z",
"dateUpdated": "2025-04-15T13:46:47.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-14201 (GCVE-0-2017-14201)
Vulnerability from nvd – Published: 2019-08-29 00:44 – Updated: 2024-09-17 00:46
VLAI
EPSS
VEX
Title
The shell DNS command can cause unpredictable results due to misuse of stack variables.
Summary
Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all.
Severity
No CVSS data available.
CWE
- CWE-416 - Use After Free
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17 | x_refsource_MISC |
| https://docs.zephyrproject.org/1.14.0/releases/re… | x_refsource_MISC |
| https://github.com/zephyrproject-rtos/zephyr/pull/13260 | x_refsource_MISC |
Date Public
2019-04-19 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T19:20:41.236Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13260"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "shell",
"vendor": "Zephyr",
"versions": [
{
"status": "affected",
"version": "prior to 1.14.0"
}
]
}
],
"datePublic": "2019-04-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-29T00:44:16.000Z",
"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"shortName": "zephyr"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13260"
}
],
"source": {
"defect": [
"ZEPSEC-17"
],
"discovery": "USER"
},
"title": "The shell DNS command can cause unpredictable results due to misuse of stack variables.",
"x_generator": {
"engine": "Vulnogram 0.0.7"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerabilities@zephyrproject.org",
"DATE_PUBLIC": "2019-04-19T00:00:00.000Z",
"ID": "CVE-2017-14201",
"STATE": "PUBLIC",
"TITLE": "The shell DNS command can cause unpredictable results due to misuse of stack variables."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "shell",
"version": {
"version_data": [
{
"version_value": "prior to 1.14.0"
}
]
}
}
]
},
"vendor_name": "Zephyr"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.7"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-416 Use After Free"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17",
"refsource": "MISC",
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17"
},
{
"name": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html",
"refsource": "MISC",
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"name": "https://github.com/zephyrproject-rtos/zephyr/pull/13260",
"refsource": "MISC",
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13260"
}
]
},
"source": {
"defect": [
"ZEPSEC-17"
],
"discovery": "USER"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"assignerShortName": "zephyr",
"cveId": "CVE-2017-14201",
"datePublished": "2019-08-29T00:44:16.325Z",
"dateReserved": "2017-09-07T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:46:36.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-14202 (GCVE-0-2017-14202)
Vulnerability from nvd – Published: 2019-08-29 00:44 – Updated: 2024-09-17 01:16
VLAI
EPSS
VEX
Title
The shell implementation does not protect against buffer overruns resulting in unpredictable behavior.
Summary
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all.
Severity
No CVSS data available.
CWE
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://docs.zephyrproject.org/1.14.0/releases/re… | x_refsource_MISC |
| https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18 | x_refsource_MISC |
| https://github.com/zephyrproject-rtos/zephyr/pull/13048 | x_refsource_MISC |
Date Public
2019-04-19 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T19:20:41.231Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13048"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "shell",
"vendor": "Zephyr",
"versions": [
{
"status": "affected",
"version": "prior to 1.14.0"
}
]
}
],
"datePublic": "2019-04-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-29T00:44:13.000Z",
"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"shortName": "zephyr"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13048"
}
],
"source": {
"defect": [
"ZEPSEC-18"
],
"discovery": "USER"
},
"title": "The shell implementation does not protect against buffer overruns resulting in unpredictable behavior.",
"x_generator": {
"engine": "Vulnogram 0.0.7"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerabilities@zephyrproject.org",
"DATE_PUBLIC": "2019-04-19T00:00:00.000Z",
"ID": "CVE-2017-14202",
"STATE": "PUBLIC",
"TITLE": "The shell implementation does not protect against buffer overruns resulting in unpredictable behavior."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "shell",
"version": {
"version_data": [
{
"version_value": "prior to 1.14.0"
}
]
}
}
]
},
"vendor_name": "Zephyr"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.7"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html",
"refsource": "MISC",
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"name": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18",
"refsource": "MISC",
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18"
},
{
"name": "https://github.com/zephyrproject-rtos/zephyr/pull/13048",
"refsource": "MISC",
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13048"
}
]
},
"source": {
"defect": [
"ZEPSEC-18"
],
"discovery": "USER"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"assignerShortName": "zephyr",
"cveId": "CVE-2017-14202",
"datePublished": "2019-08-29T00:44:13.046Z",
"dateReserved": "2017-09-07T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:16:38.814Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-14199 (GCVE-0-2017-14199)
Vulnerability from nvd – Published: 2019-04-12 16:20 – Updated: 2024-08-05 19:20
VLAI
EPSS
VEX
Summary
A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.
Severity
No CVSS data available.
CWE
- Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-12 | x_refsource_CONFIRM |
| https://github.com/zephyrproject-rtos/zephyr/pull/6158 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zephyr | getaddrinfo |
Affected:
1.9.0
Affected: 1.10.0 |
Date Public
2018-02-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T19:20:41.285Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-12"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/6158"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "getaddrinfo",
"vendor": "Zephyr",
"versions": [
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.10.0"
}
]
}
],
"datePublic": "2018-02-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A buffer overflow has been found in the Zephyr Project\u0027s getaddrinfo() implementation in 1.9.0 and 1.10.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Buffer Overflow",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-12T16:20:02.000Z",
"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"shortName": "zephyr"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-12"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/6158"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerabilities@zephyrproject.org",
"ID": "CVE-2017-14199",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "getaddrinfo",
"version": {
"version_data": [
{
"version_value": "1.9.0"
},
{
"version_value": "1.10.0"
}
]
}
}
]
},
"vendor_name": "Zephyr"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A buffer overflow has been found in the Zephyr Project\u0027s getaddrinfo() implementation in 1.9.0 and 1.10.0."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-12",
"refsource": "CONFIRM",
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-12"
},
{
"name": "https://github.com/zephyrproject-rtos/zephyr/pull/6158",
"refsource": "CONFIRM",
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/6158"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"assignerShortName": "zephyr",
"cveId": "CVE-2017-14199",
"datePublished": "2019-04-12T16:20:02.000Z",
"dateReserved": "2017-09-07T00:00:00.000Z",
"dateUpdated": "2024-08-05T19:20:41.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-3333 (GCVE-0-2022-3333)
Vulnerability from cvelistv5 – Published: 2022-09-28 04:35 – Updated: 2025-04-15 13:46
VLAI
EPSS
VEX
Title
Zephyr Project Manager REST Call cross site scripting
Summary
A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.2.5 is able to address this issue. It is recommended to upgrade the affected component. VDB-209370 is the identifier assigned to this vulnerability.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-707 - Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/bfd8a7aa-5977-4f… | x_refsource_MISC |
| https://vuldb.com/?id.209370 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zephyr | Project Manager |
Affected:
3.2.0
Affected: 3.2.1 Affected: 3.2.2 Affected: 3.2.3 Affected: 3.2.4 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:07:06.457Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/bfd8a7aa-5977-4fe5-b2fc-12bf93caf3ed"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.209370"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3333",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T16:59:51.951219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T13:46:47.321Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Project Manager",
"vendor": "Zephyr",
"versions": [
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.2.1"
},
{
"status": "affected",
"version": "3.2.2"
},
{
"status": "affected",
"version": "3.2.3"
},
{
"status": "affected",
"version": "3.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.2.5 is able to address this issue. It is recommended to upgrade the affected component. VDB-209370 is the identifier assigned to this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-707",
"description": "CWE-707 Improper Neutralization -\u003e CWE-74 Injection -\u003e CWE-79 Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-28T04:35:12.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/bfd8a7aa-5977-4fe5-b2fc-12bf93caf3ed"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.209370"
}
],
"title": "Zephyr Project Manager REST Call cross site scripting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2022-3333",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "Zephyr Project Manager REST Call cross site scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Project Manager",
"version": {
"version_data": [
{
"version_value": "3.2.0"
},
{
"version_value": "3.2.1"
},
{
"version_value": "3.2.2"
},
{
"version_value": "3.2.3"
},
{
"version_value": "3.2.4"
}
]
}
}
]
},
"vendor_name": "Zephyr"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.2.5 is able to address this issue. It is recommended to upgrade the affected component. VDB-209370 is the identifier assigned to this vulnerability."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-707 Improper Neutralization -\u003e CWE-74 Injection -\u003e CWE-79 Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/bfd8a7aa-5977-4fe5-b2fc-12bf93caf3ed",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/bfd8a7aa-5977-4fe5-b2fc-12bf93caf3ed"
},
{
"name": "https://vuldb.com/?id.209370",
"refsource": "MISC",
"url": "https://vuldb.com/?id.209370"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2022-3333",
"datePublished": "2022-09-28T04:35:12.000Z",
"dateReserved": "2022-09-27T00:00:00.000Z",
"dateUpdated": "2025-04-15T13:46:47.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-14201 (GCVE-0-2017-14201)
Vulnerability from cvelistv5 – Published: 2019-08-29 00:44 – Updated: 2024-09-17 00:46
VLAI
EPSS
VEX
Title
The shell DNS command can cause unpredictable results due to misuse of stack variables.
Summary
Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all.
Severity
No CVSS data available.
CWE
- CWE-416 - Use After Free
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17 | x_refsource_MISC |
| https://docs.zephyrproject.org/1.14.0/releases/re… | x_refsource_MISC |
| https://github.com/zephyrproject-rtos/zephyr/pull/13260 | x_refsource_MISC |
Date Public
2019-04-19 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T19:20:41.236Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13260"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "shell",
"vendor": "Zephyr",
"versions": [
{
"status": "affected",
"version": "prior to 1.14.0"
}
]
}
],
"datePublic": "2019-04-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-29T00:44:16.000Z",
"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"shortName": "zephyr"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13260"
}
],
"source": {
"defect": [
"ZEPSEC-17"
],
"discovery": "USER"
},
"title": "The shell DNS command can cause unpredictable results due to misuse of stack variables.",
"x_generator": {
"engine": "Vulnogram 0.0.7"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerabilities@zephyrproject.org",
"DATE_PUBLIC": "2019-04-19T00:00:00.000Z",
"ID": "CVE-2017-14201",
"STATE": "PUBLIC",
"TITLE": "The shell DNS command can cause unpredictable results due to misuse of stack variables."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "shell",
"version": {
"version_data": [
{
"version_value": "prior to 1.14.0"
}
]
}
}
]
},
"vendor_name": "Zephyr"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.7"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-416 Use After Free"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17",
"refsource": "MISC",
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17"
},
{
"name": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html",
"refsource": "MISC",
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"name": "https://github.com/zephyrproject-rtos/zephyr/pull/13260",
"refsource": "MISC",
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13260"
}
]
},
"source": {
"defect": [
"ZEPSEC-17"
],
"discovery": "USER"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"assignerShortName": "zephyr",
"cveId": "CVE-2017-14201",
"datePublished": "2019-08-29T00:44:16.325Z",
"dateReserved": "2017-09-07T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:46:36.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-14202 (GCVE-0-2017-14202)
Vulnerability from cvelistv5 – Published: 2019-08-29 00:44 – Updated: 2024-09-17 01:16
VLAI
EPSS
VEX
Title
The shell implementation does not protect against buffer overruns resulting in unpredictable behavior.
Summary
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all.
Severity
No CVSS data available.
CWE
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://docs.zephyrproject.org/1.14.0/releases/re… | x_refsource_MISC |
| https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18 | x_refsource_MISC |
| https://github.com/zephyrproject-rtos/zephyr/pull/13048 | x_refsource_MISC |
Date Public
2019-04-19 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T19:20:41.231Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13048"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "shell",
"vendor": "Zephyr",
"versions": [
{
"status": "affected",
"version": "prior to 1.14.0"
}
]
}
],
"datePublic": "2019-04-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-29T00:44:13.000Z",
"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"shortName": "zephyr"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13048"
}
],
"source": {
"defect": [
"ZEPSEC-18"
],
"discovery": "USER"
},
"title": "The shell implementation does not protect against buffer overruns resulting in unpredictable behavior.",
"x_generator": {
"engine": "Vulnogram 0.0.7"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerabilities@zephyrproject.org",
"DATE_PUBLIC": "2019-04-19T00:00:00.000Z",
"ID": "CVE-2017-14202",
"STATE": "PUBLIC",
"TITLE": "The shell implementation does not protect against buffer overruns resulting in unpredictable behavior."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "shell",
"version": {
"version_data": [
{
"version_value": "prior to 1.14.0"
}
]
}
}
]
},
"vendor_name": "Zephyr"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.7"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html",
"refsource": "MISC",
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
},
{
"name": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18",
"refsource": "MISC",
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18"
},
{
"name": "https://github.com/zephyrproject-rtos/zephyr/pull/13048",
"refsource": "MISC",
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13048"
}
]
},
"source": {
"defect": [
"ZEPSEC-18"
],
"discovery": "USER"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"assignerShortName": "zephyr",
"cveId": "CVE-2017-14202",
"datePublished": "2019-08-29T00:44:13.046Z",
"dateReserved": "2017-09-07T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:16:38.814Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-14199 (GCVE-0-2017-14199)
Vulnerability from cvelistv5 – Published: 2019-04-12 16:20 – Updated: 2024-08-05 19:20
VLAI
EPSS
VEX
Summary
A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.
Severity
No CVSS data available.
CWE
- Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-12 | x_refsource_CONFIRM |
| https://github.com/zephyrproject-rtos/zephyr/pull/6158 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zephyr | getaddrinfo |
Affected:
1.9.0
Affected: 1.10.0 |
Date Public
2018-02-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T19:20:41.285Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-12"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/6158"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "getaddrinfo",
"vendor": "Zephyr",
"versions": [
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.10.0"
}
]
}
],
"datePublic": "2018-02-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A buffer overflow has been found in the Zephyr Project\u0027s getaddrinfo() implementation in 1.9.0 and 1.10.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Buffer Overflow",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-12T16:20:02.000Z",
"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"shortName": "zephyr"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-12"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/6158"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerabilities@zephyrproject.org",
"ID": "CVE-2017-14199",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "getaddrinfo",
"version": {
"version_data": [
{
"version_value": "1.9.0"
},
{
"version_value": "1.10.0"
}
]
}
}
]
},
"vendor_name": "Zephyr"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A buffer overflow has been found in the Zephyr Project\u0027s getaddrinfo() implementation in 1.9.0 and 1.10.0."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-12",
"refsource": "CONFIRM",
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-12"
},
{
"name": "https://github.com/zephyrproject-rtos/zephyr/pull/6158",
"refsource": "CONFIRM",
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/6158"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"assignerShortName": "zephyr",
"cveId": "CVE-2017-14199",
"datePublished": "2019-04-12T16:20:02.000Z",
"dateReserved": "2017-09-07T00:00:00.000Z",
"dateUpdated": "2024-08-05T19:20:41.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}