Malicious Package

Overview @uc-maps/layer-select.react is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if th...

MAL-2022-677 Malicious code in @uc-maps/api.react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f409bbd4d44a1d019c99abc6d3f4c3fdb6caf61568a7a1235c25fe5ff3995c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-678 Malicious code in @uc-maps/boundaries-core.react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f279f06f2a6375dfe5f8632d2e53e7c315fed145e3d5babe3fe2338fd70e1e8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-679 Malicious code in @uc-maps/geospatial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6991935d20b411c2ed3710ebf423c8b205e514c20f5ca2937bd0cfc55ad8d2f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-680 Malicious code in @uc-maps/layer-select.react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e16c28c35ea063cec1fb2f23764d6be10526f72c11c42bc40879a61a2383ff0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-683 Malicious code in @uc-maps/provider-google.react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b2ee3e9a228c29b1fa9a48eab565e4eee93260225f30d535417f36ee2b48d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-682 Malicious code in @uc-maps/parcel-shapes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a5355ff2e8d842acde41df4dad7dba63eabaac16403d4789e204cdcbd93035e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-686 Malicious code in @uc-maps/tile-layers.react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af3f6d0d5c3454a78142a0ac415c1e72c55d7f50e15e914045f1c9940ae83d3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2017-20041

A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers URL. It is possible to launch the attack remotely...

CVE-2017-20041

A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers URL. It is possible to launch the attack remotely...

Hardcoded credentials

A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers URL. It is possible to launch the attack remotely...

CVE-2017-20041 Ucweb UC Browser HTML URL improper restriction of rendered ui layers

A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers URL. It is possible to launch the attack remotely...

CVE-2017-20041 Ucweb UC Browser HTML URL improper restriction of rendered ui layers

A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers URL. It is possible to launch the attack remotely...

CVE-2017-20041

UC Browser 11.2.5.932 is affected by CVE-2017-20041 due to the HTML Handler: manipulation of the title argument leads to improper restriction of rendered UI layers (URL). The issue is exploitable remotely and the exploit has been disclosed publicly. No patch/version remediation details are provid...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to a memory leak via the function ucclose at /my/unicorn/uc.c. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike...

flynn/noise has improper nonce handling yielding potential state DoS

The Go package github.com/flynn/noise, a Noise Protocol implementation, has two bugs in nonce handling in versions prior to v1.0.0. Issue 1: Potential nonce overflow If 264 18.4 quintillion or more messages are encrypted with Encrypt after handshaking, the nonce counter will wrap around, causing...

CVE-2021-26706

An issue was discovered in libmem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: MemPoolCreate, MemDynPoolCreate, and MemDynPoolCreateHW. Because these functions...

Integer overflow

An issue was discovered in libmem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: MemPoolCreate, MemDynPoolCreate, and MemDynPoolCreateHW. Because these functions...

CVE-2021-26706

The CVE-2021-26706 issue affects Micrium uC/OS uC/LIB 1.38.x and 1.39.00, where Mem_PoolCreate, Mem_DynPoolCreate, and Mem_DynPoolCreateHW can overflow when pool sizes exceed address space due to multiplication in size calculations. This can yield a smaller-than-expected memory pool and may be ex...

CVE-2021-26706

An issue was discovered in libmem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: MemPoolCreate, MemDynPoolCreate, and MemDynPoolCreateHW. Because these functions...