Records30All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high14CVSS 7.0–8.9
Exploited now
Yubico records in CISA KEVNo Yubico vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority LOW 37
In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02296 · Published 2019-03-05 · No fix listed CWE-908
Priority LOW 31
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow.
CVSS 3.0MEDIUM 6.8· Physical · No auth · No interaction · EPSS 0.00499 · Published 2019-03-17 · No fix listed CWE-119
