CVE Daily – Ember https://cvedaily.com/pages/tags/emberjs.html CVE Daily – Ember en Wed, 03 Jun 2026 21:27:05 +0000 [Medium] CVE-2025-1394 – The Ember ZNet stack’s packet buffer manager may read out of bound memory leadin... https://nvd.nist.gov/vuln/detail/CVE-2025-1394 https://nvd.nist.gov/vuln/detail/CVE-2025-1394 Wed, 30 Jul 2025 08:15:33 +0000 Medium CVE-2025-1394

The Ember ZNet stack’s packet buffer manager may read out of bound memory leading to an assert, causing a Denial of Service (DoS).

CVSS: 5.9 · CWE: CWE-252

View on NVD

]]> [Medium] CVE-2024-6351 – A malformed packet can cause a buffer overflow in the NWK/APS layer of the Ember... https://nvd.nist.gov/vuln/detail/CVE-2024-6351 https://nvd.nist.gov/vuln/detail/CVE-2024-6351 Tue, 28 Jan 2025 14:15:30 +0000 Medium CVE-2024-6351

A malformed packet can cause a buffer overflow in the NWK/APS layer of the Ember ZNet stack and lead to an assert

CVSS: 4.3 · CWE: CWE-120

View on NVD

]]> [Medium] CVE-2024-6352 – A malformed packet can cause a buffer overflow in the APS layer of the Ember ZNe... https://nvd.nist.gov/vuln/detail/CVE-2024-6352 https://nvd.nist.gov/vuln/detail/CVE-2024-6352 Mon, 13 Jan 2025 17:15:17 +0000 Medium CVE-2024-6352

A malformed packet can cause a buffer overflow in the APS layer of the Ember ZNet stack and lead to an assert

CVSS: 4.3 · CWE: CWE-120

View on NVD

]]> [Medium] CVE-2023-51394 – High traffic environments may result in NULL Pointer Dereference vulnerability i... https://nvd.nist.gov/vuln/detail/CVE-2023-51394 https://nvd.nist.gov/vuln/detail/CVE-2023-51394 Fri, 23 Feb 2024 20:15:51 +0000 Medium CVE-2023-51394

High traffic environments may result in NULL Pointer Dereference vulnerability in Silicon Labs's Ember ZNet SDK before v7.4.0, causing a system crash.

CVSS: 5.3 · CWE: CWE-476

View on NVD

]]> [Medium] CVE-2023-51393 – Due to an allocation of resources without limits, an uncontrolled resource consu... https://nvd.nist.gov/vuln/detail/CVE-2023-51393 https://nvd.nist.gov/vuln/detail/CVE-2023-51393 Fri, 23 Feb 2024 20:15:51 +0000 Medium CVE-2023-51393

Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 (delivered as part of Silicon Labs Gecko SDK v4.4.0) which may enable attackers to trigger a bus fault and crash of the device, requiring a reboot in order to rejoin the network.

CVSS: 5.3 · CWE: CWE-770

View on NVD

]]> [Medium] CVE-2023-51392 – Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated... https://nvd.nist.gov/vuln/detail/CVE-2023-51392 https://nvd.nist.gov/vuln/detail/CVE-2023-51392 Fri, 23 Feb 2024 17:15:07 +0000 Medium CVE-2023-51392

Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks.

CVSS: 6.2 · CWE: CWE-1240

View on NVD

]]> [High] CVE-2023-6874 – Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through ... https://nvd.nist.gov/vuln/detail/CVE-2023-6874 https://nvd.nist.gov/vuln/detail/CVE-2023-6874 Mon, 05 Feb 2024 18:15:51 +0000 High CVE-2023-6874

Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number

CVSS: 7.5 · CWE: CWE-312

View on NVD

]]> [Medium] CVE-2023-41096 – Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK... https://nvd.nist.gov/vuln/detail/CVE-2023-41096 https://nvd.nist.gov/vuln/detail/CVE-2023-41096 Thu, 26 Oct 2023 14:15:08 +0000 Medium CVE-2023-41096

Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs Ember ZNet SDK: 7.3.1 and earlier.

CVSS: 6.8 · CWE: CWE-312

View on NVD

]]> [Critical] CVE-2023-41094 – TouchLink packets processed after timeout or out of range due to Operation on a ... https://nvd.nist.gov/vuln/detail/CVE-2023-41094 https://nvd.nist.gov/vuln/detail/CVE-2023-41094 Wed, 04 Oct 2023 21:15:09 +0000 Critical CVE-2023-41094

TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration This issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected

CVSS: 10.0 · CWE: CWE-940

View on NVD

]]> [Medium] CVE-2022-24939 – A malformed packet containing an invalid destination address, causes a stack ove... https://nvd.nist.gov/vuln/detail/CVE-2022-24939 https://nvd.nist.gov/vuln/detail/CVE-2022-24939 Fri, 18 Nov 2022 00:15:09 +0000 Medium CVE-2022-24939

A malformed packet containing an invalid destination address, causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error.

CVSS: 5.7 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2022-24938 – A malformed packet causes a stack overflow in the Ember ZNet stack. This causes ... https://nvd.nist.gov/vuln/detail/CVE-2022-24938 https://nvd.nist.gov/vuln/detail/CVE-2022-24938 Mon, 14 Nov 2022 18:15:16 +0000 Medium CVE-2022-24938

A malformed packet causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error.

CVSS: 6.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2022-24937 – Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerab... https://nvd.nist.gov/vuln/detail/CVE-2022-24937 https://nvd.nist.gov/vuln/detail/CVE-2022-24937 Mon, 14 Nov 2022 18:15:16 +0000 Medium CVE-2022-24937

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows Overflow Buffers.

CVSS: 6.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2013-4170 – In general, Ember.js escapes or strips any user-supplied content before insertin... https://nvd.nist.gov/vuln/detail/CVE-2013-4170 https://nvd.nist.gov/vuln/detail/CVE-2013-4170 Thu, 30 Jun 2022 13:15:08 +0000 Medium CVE-2013-4170

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context o…

CVSS: 6.1 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2014-0014 – Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x befor... https://nvd.nist.gov/vuln/detail/CVE-2014-0014 https://nvd.nist.gov/vuln/detail/CVE-2014-0014 Thu, 15 Feb 2018 21:29:00 +0000 Medium CVE-2014-0014

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application using the "{{group}}" Helper and a crafted payload.

CVSS: 5.4 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2014-0013 – Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x befor... https://nvd.nist.gov/vuln/detail/CVE-2014-0013 https://nvd.nist.gov/vuln/detail/CVE-2014-0013 Thu, 15 Feb 2018 21:29:00 +0000 Medium CVE-2014-0013

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value and also contain the `{{this}}` special Handlebars variable.

CVSS: 5.4 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2015-1866 – Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1... https://nvd.nist.gov/vuln/detail/CVE-2015-1866 https://nvd.nist.gov/vuln/detail/CVE-2015-1866 Wed, 20 Sep 2017 18:29:00 +0000 Medium CVE-2015-1866

Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.

CVSS: 6.1 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2015-7565 – Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11... https://nvd.nist.gov/vuln/detail/CVE-2015-7565 https://nvd.nist.gov/vuln/detail/CVE-2015-7565 Thu, 13 Apr 2017 14:59:00 +0000 Medium CVE-2015-7565

Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.

CVSS: 6.1 · CWE: CWE-79

View on NVD

]]> [Low] CVE-2014-0046 – Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x... https://nvd.nist.gov/vuln/detail/CVE-2014-0046 https://nvd.nist.gov/vuln/detail/CVE-2014-0046 Thu, 27 Feb 2014 15:55:04 +0000 Low CVE-2014-0046

Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.

CVSS: 2.6 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2010-3355 – Ember 0.5.7 places a zero-length directory name in the LD_LIBRARY_PATH, which al... https://nvd.nist.gov/vuln/detail/CVE-2010-3355 https://nvd.nist.gov/vuln/detail/CVE-2010-3355 Wed, 20 Oct 2010 18:00:03 +0000 Medium CVE-2010-3355

Ember 0.5.7 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

CVSS: 6.9 · CWE: N/A

View on NVD

]]>