Cross site request forgery (csrf)

A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-13582

Micrium uC-HTTP 3.01.00’s HTTP Server contains a denial-of-service vulnerability due to an unchecked return value in the header-parsing path. Specifically, in the boundary parsing of multipart forms, Str_Char_N may return NULL, and the code proceeds to dereference it, causing a crash (segmentatio...

CVE-2020-13582

A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability...

Vulnerability Spotlight: Denial-of-service vulnerabilities in Micrium uc-HTTP’s HTTP server

Kelly Leuschner of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered two vulnerabilities in Micrium uc-HTTP’s HTTP server that could cause denial-of-service conditions. An attacker could trigger these vulnerabilities by targeting the user machine...

Micrium uC-HTTP HTTP Server null pointer dereference denial-of-service vulnerability

Summary A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability. Tested Versions Micrium uC-HTTP 3.01.00 Product URLs...

Micrium uC-HTTP HTTP Server unchecked return value denial-of-service vulnerability

Summary A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability. Tested Versions Micrium uC-HTTP 3.01.00 Product URLs...

Binary Vulnerability in ZTE UC TP220 Upper PC Screen Setting Tool (CNVD-2020-70592)

Shenzhen Zhongda U-control Technology Co., Ltd. is an industrial visual touch control products - human-machine interface, text display, programmable logic controller PLC core technology research and development and overcome, professional development, sales as one of the high-tech enterprises. A...

Binary Vulnerability in ZTE UC TP220 Upper PC Screen Setting Tool

Shenzhen Zhongda U-control Technology Co., Ltd. is an industrial visual touch control products - human-machine interface, text display, programmable logic controller PLC core technology research and development and overcome, professional development, sales as one of the high-tech enterprises. A...

Binary Vulnerability in Zhongda UC YKBuilder V5.1

YKBuilder is a software for constructing embedded integrated development software. A binary vulnerability exists in ZTE YKBuilder V5.1. An attacker can exploit this vulnerability to construct malformed files that could cause the program to crash...

CVE-2020-7364

User Interface UI Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions...

CVE-2020-7363

User Interface UI Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions...

Design/Logic Flaw

User Interface UI Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions...

CVE-2020-7363

CVE-2020-7363 affects UCWeb UC Browser versions 13.0.8 and earlier, enabling UI/address-bar spoofing through JavaScript timing tricks that can mislead users about the page origin. Exploitation requires visiting a page hosting executable JavaScript; it can trigger in-browser content or popups that...

CVE-2020-7364

CVE-2020-7364 is a UI-based spoofing vulnerability in UCWeb UC Browser (Android) affecting version 13.0.8 and earlier. The root cause is a misrepresentation in the address bar, enabling an attacker to obfuscate the true source of data via JavaScript timing tricks, potentially causing a pop-up or ...

Mobile Browser Bugs Open Safari, Opera Users to Malware

A set of address-bar spoofing vulnerabilities that affect a number of mobile browsers open the door for malware delivery, phishing and disinformation campaigns. The bugs, reported by Rapid7 and independent researcher Rafay Baloch, affect six browsers, ranging from the common Apple Safari, Opera...

ucce-plumas-sierra.ucdavis.edu Cross Site Scripting vulnerability OBB-1265143

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

ucprc.ucdavis.edu Cross Site Scripting vulnerability OBB-1196326

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Huawei Data Communication: Multiple Vulnerabilities Released on Microsoft security advisory 4025685 (huawei-sa-20170909-01-windows)

Microsoft had released a Security Advisory 4025685 on June 14 to fix multiple critical security vulnerabilities in such systems as Microsoft Windows XP, Windows Server 2003, Windows VISTA, and Windows 8. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a...

CVE-2019-19865

Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. An attacker could exploit this by convincing an authenticated user to inject arbitrary JavaScript code in the Profile Name field. A browser would execute this stored XSS payload...

CVE-2019-19866

Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By iterating the value of conferenceId to getMailFunction in the JSON API, one can enumerate all conferences scheduled on the platform, with...