IDEMIA: CVE Program partner

CVEs, 365 days07 all time, 0 rejected

Quality-median 99%

CVSS by the CNA-share of records

CWE-share of records

Affected versions-not n/a or unspecified

CVSS added by CISA-lower is better

Organisation	IDEMIA
Role	CNA
Type	Researcher, Vendor
Reports to	mitre
Scope	All IDEMIA products (supported products and end-of-life/end-of-service products), as well as vulnerabilities in third-party software discovered by IDEMIA that are not in another CNA’s scope.
Advisories	https://www.idemia.com/vulnerability-information

CVE-2023-33222 2023-12-15 · CVSS 6.8
When handling contactless cards, usage of a specific function to get additional information from the card which doesn't check the boundary on the data
CVE-2023-33221 2023-12-15 · CVSS 6.8
When reading DesFire keys, the function that reads the card isn't properly checking the boundaries when copying internally the data received. This all
CVE-2023-33220 2023-12-15 · CVSS 9.1
During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes to check. This allows a stack-b
CVE-2023-33219 2023-12-15 · CVSS 9.1
The handler of the retrofit validation command doesn't properly check the boundaries when performing certain validation operations. This allows a stack-ba
CVE-2023-33218 2023-12-15 · CVSS 9.1
The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow. This could potentially lead to a Remote Code exe
CVE-2023-33217 2023-12-15 · CVSS 7.5
By abusing a design flaw in the firmware upgrade mechanism of the impacted terminal it's possible to cause a permanent denial of service for the terminal. the
CVE-2023-4667 2023-11-28 · CVSS 8.1
The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then

IDEMIA