Reading uninitialized memory can cause UB (`Deserializer::read_vec`)

Deserializer::readvec created an uninitialized buffer and passes it to a user-provided Read implementation Deserializer.reader.readexact. Passing an uninitialized buffer to an arbitrary Read implementation is currently defined as undefined behavior in Rust. Official documentation for the Read tra...

SyncChannel<T> can move 'T: !Send' to other threads

Affected versions of this crate unconditionally implement Send/Sync for SyncChannel. SyncChannel doesn't provide access to &T but merely serves as a channel that consumes and returns owned T. Users can create UB in safe Rust by sending T: !Send to other threads with SyncChannel::send/recv APIs...

ub-ridder.de Cross Site Scripting vulnerability OBB-1434586

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

RUSTSEC-2019-0020 fix unsound APIs that could lead to UB

Affected versions of this crate API could use uninitialized memory with some APIs in special cases, like use the API in none generator context. This could lead to UB. The flaw was corrected by This patch fixes all those issues above...

fix unsound APIs that could lead to UB

Affected versions of this crate API could use uninitialized memory with some APIs in special cases, like use the API in none generator context. This could lead to UB. The flaw was corrected by This patch fixes all those issues above...

RUSTSEC-2019-0038 Fix for UB in failure to catch panics crossing FFI boundaries

Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which is a form of UB. This flaw was corrected by this commit1 which was included in version 2.6.0. 1: https://github.com/jnqnfe/pulse-binding-rust/commit/7fd282aef7787577c385aed88cb25d004b85f494...

Fix for UB in failure to catch panics crossing FFI boundaries

Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which is a form of UB. This flaw was corrected by this commit1 which was included in version 2.6.0. 1: https://github.com/jnqnfe/pulse-binding-rust/commit/7fd282aef7787577c385aed88cb25d004b85f494...

ub-katalog.fernuni-hagen.de XSS vulnerability

Open Bug Bounty ID: OBB-668585 Description| Value ---|--- Affected Website:| ub-katalog.fernuni-hagen.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

FiberHome VDSL2 Modem HG 150-UB Security Bypass Vulnerability (CNVD-2018-08814)

FiberHome VDSL2 Modem HG 150-UB is a modem product from China FiberHome. A security vulnerability exists in the FiberHome VDSL2 Modem HG 150-UB. An attacker can exploit the vulnerability to bypass authentication...

CVE-2018-9249

FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass by ignoring the parent.location='login.html' JavaScript code in the response to an unauthenticated request...

Authentication flaw

FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass by ignoring the parent.location='login.html' JavaScript code in the response to an unauthenticated request...

CVE-2018-9248

FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header...

CVE-2018-9248

CVE-2018-9248 affects FiberHome VDSL2 Modem HG 150-UB. The flaw allows authentication bypass via the HTTP cookie header “Cookie: Name=0admin” due to improper session handling and a hard-coded/plain-text cookie. Public evidence (NVD entry, CNVD-2018-08815, Exploit-DB entry) confirms the bypass can...

CVE-2018-9249

The CVE-2018-9249 issue affects FiberHome VDSL2 Modem HG 150-UB where authentication can be bypassed by the device’s response not enforcing login.html, due to the client-side JavaScript check (parent.location='login.html') being ignored on unauthenticated requests. Affected component: the modem’s...

CVE-2018-9248

FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header...

CVE-2018-9249

FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass by ignoring the parent.location='login.html' JavaScript code in the response to an unauthenticated request...

CVE-2018-6329

CVE-2018-6329 affects Unitrends Backup (UB) prior to 10.1.0. The issue is a SQL injection in the libbpext.so authentication path, allowing a remote attacker to bypass authentication and place a privilege escalation exploit on the target, enabling arbitrary command execution. Public disclosures an...

ub-iq.com XSS vulnerability

Open Bug Bounty ID: OBB-555970 Description| Value ---|--- Affected Website:| ub-iq.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ub-iq.com XSS vulnerability

Open Bug Bounty ID: OBB-549139 Description| Value ---|--- Affected Website:| ub-iq.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ub-iq.com XSS vulnerability

Open Bug Bounty ID: OBB-512297 Description| Value ---|--- Affected Website:| ub-iq.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure...