2.2.0

DATE	CVE	VULNERABILITY TITLE	RISK
2021-05-25	CVE-2020-13600	Out-of-bounds Write vulnerability in Zephyrproject Zephyr Malformed SPI in response for eswifi can corrupt kernel memory. low complexity zephyrproject CWE-787	7.6
2021-05-25	CVE-2020-13601	Out-of-bounds Read vulnerability in Zephyrproject Zephyr Possible read out of bounds in dns read. network low complexity zephyrproject CWE-125 critical	9.8
2021-05-25	CVE-2021-3320	Type Confusion vulnerability in Zephyrproject Zephyr Type Confusion in 802154 ACK Frames Handling. network low complexity zephyrproject CWE-843	7.5
2020-06-05	CVE-2020-10071	Classic Buffer Overflow vulnerability in Zephyrproject Zephyr The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. network low complexity zephyrproject CWE-120 critical	9.8
2020-06-05	CVE-2020-10070	Classic Buffer Overflow vulnerability in Zephyrproject Zephyr In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. network low complexity zephyrproject CWE-120 critical	9.8
2020-06-05	CVE-2020-10063	Integer Overflow or Wraparound vulnerability in Zephyrproject Zephyr A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service. network low complexity zephyrproject CWE-190	7.5
2020-06-05	CVE-2020-10062	Off-by-one Error vulnerability in Zephyrproject Zephyr An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. network low complexity zephyrproject CWE-193 critical	9.8
2020-05-11	CVE-2020-10060	Access of Uninitialized Pointer vulnerability in Zephyrproject Zephyr 2.1.0/2.2.0/2.3.0 In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places. network low complexity zephyrproject CWE-824	6.5
2020-05-11	CVE-2020-10059	Improper Certificate Validation vulnerability in Zephyrproject Zephyr 2.1.0/2.2.0 The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. network high complexity zephyrproject CWE-295	4.8
2020-05-11	CVE-2020-10022	Classic Buffer Overflow vulnerability in Zephyrproject Zephyr 2.1.0/2.2.0 A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. network low complexity zephyrproject CWE-120 critical	9.8