CVE-2020-24339

The CVE concerns picoTCP/picoTCP-NG up to version 1.7.0 where DNS domain name decompression (pico_dns_decompress_name in pico_dns_common.c) does not validate compression pointer offsets against the DNS packet data, causing out-of-bounds reads and Denial-of-Service. The issue affects picoTCP and p...

CVE-2020-24338

Summary of CVE-2020-24338 (AMNESIA:33) from provided sources : It affects picoTCP (and picoTCP-NG) up to version 1.7.0, where DNS domain name record decompression in pico_dns_decompress_name() fails to validate compression pointer offsets against DNS response data. This can cause out-of-bounds wr...

The vulnerability of Google Chrome’s networking component allows a hacker to replace the domain name.

The vulnerability of Google Chrome’s networking component is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability can allow a malicious actor to remotely replace a domain name...

Courier Management System 1.0 Cross Site Scripting

Exploit Title: Courier Management System 1.0 - 'First Name' Stored XSS Exploit Author: Zhaiyi Zeo Date: 2020-12-11 Google Dork: N/A Vendor Homepage: https://www.sourcecodester.com/php/14615/task-management-system-using-phpmysqli-source-code.html Software Link:...

PT-2020-15012 · Fnet · Fnet

Name of the Vulnerable Software and Affected Versions: FNET versions through 4.6.4 Description: An issue was discovered in the code that initializes the DNS client interface structure, where it does not set sufficiently random transaction IDs, always setting them to 1 in fnet dns poll in fnet...

PT-2020-15009 · Fnet · Fnet

Name of the Vulnerable Software and Affected Versions: FNET versions through 4.6.4 Description: An issue was discovered in the code for processing the hostname from an LLMNR request, which doesn't check for '0' termination. This may lead to Information Disclosure in fnet llmnr poll in fnet llmnr....

PT-2020-15689

Name of the Vulnerable Software and Affected Versions picoTCP versions through 1.7.0 Description An issue was discovered in the DNS domain name record decompression functionality in pico dns decompress name in pico dns common.c. This issue does not validate the compression pointer offset values...

CVE-2020-26966

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This...

Contiki-NG Security Feature Issue Vulnerability

Contiki-NG is an open source cross-platform operating system for next-generation IoT Internet of Things devices. A security signature issue vulnerability exists in Contiki-NG that stems from functions used to initialize the DNS client interface structure not setting enough random transaction IDs...

Contiki and Contiki-NG Buffer Error Vulnerabilities

Contiki is an open source cross-platform operating system for IoT Internet of Things devices.Contiki-NG is an open source cross-platform operating system for next-generation IoT Internet of Things devices. Contiki and Contiki-NG suffer from a buffer error vulnerability that stems from processing...

Contiki Input Validation Error Vulnerability

Contiki is an open source cross-platform operating system for IoT Internet of Things devices. Contiki 3.0 suffers from an input validation error vulnerability that stems from the DNS transaction ID not being randomized enough. If the DNS cache is very small four entries, this can facilitate a DNS...

Vulnerabilities fixed in Microsoft Windows

There are several vulnerabilities in Microsoft Windows. The vulnerabilities allow a malicious person to: - execute arbitrary code with user privileges; - grant themselves elevated privileges; - circumvent security measures; - gain access to sensitive data; - construct a DNS cache poisoning attack...

Contiki Security Vulnerabilities

Contiki is an open source cross-platform operating system for IoT Internet of Things devices. Contiki 3.0 suffers from a security vulnerability that stems from parsing incoming DNS packets without checking if the domain name ends in null. This allows an attacker to compromise memory with a crafte...

picoTCP Buffer Error Vulnerability

Altran EESY Belgium Picotcp is a software from the Altran EESY Belgium community that provides TCP/IP protocol support for real-time systems. A buffer error vulnerability exists in picoTCP that stems from a lack of bounds checking in functions that resolve domain names, which allows an attacker t...

Contiki and Contiki-NG Buffer Error Vulnerabilities

Contiki is an open source cross-platform operating system for IoT Internet of Things devices.Contiki-NG is an open source cross-platform operating system for next-generation IoT Internet of Things devices. Contiki-NG and Contiki suffer from a buffer error vulnerability that stems from a function...

Contiki and Contiki-NG Buffer Error Vulnerabilities

Contiki is an open source cross-platform operating system for IoT Internet of Things devices.Contiki-NG is an open source cross-platform operating system for next-generation IoT Internet of Things devices. Contiki-NG and Contiki-OS suffer from a buffer error vulnerability that stems from a lack o...

Contiki 缓冲区错误漏洞

Nut/OS is a modular, open-source real-time operating system for embedded platforms. A denial of service and remote code execution vulnerability exists in the DNS implementation in Ethernut in Nut/OS 5.1. The vulnerability stems from a failure to check the DNS response data length. An attacker cou...

Content Spoofing

Google Chrome is vulnerable to content spoofing. A remote attacker could spoof the contents of the URL bar via a crafted domain name...

Content Spoofing

Google Chrome is vulnerable to content spoofing. A remote attacker could spoof the contents of the URL bar via a crafted domain name due to incorrect handling of confusable characters in URL Formatter...

Content Spoofing

chromium is vulnerable to content spoofing. Incorrect handling of confusable characters in URL Formatter allowes a remote attacker to spoof the contents of the Omnibox URL bar via a malicious domain name...