104 matches found
Buffer overflow
An issue was discovered on GL.iNet devices before 3.216. The function guci2get found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer...
PT-2023-23354 · Gl.Inet · Gl.Inet
Name of the Vulnerable Software and Affected Versions: GL.iNet devices versions prior to 3.216 Description: An issue was discovered where the function guci2 get found in libglutil.so has a buffer overflow. This occurs when an item is requested from a UCI context and the value is pasted into a cha...
CVE-2023-31475
An issue was discovered on GL.iNet devices before 3.216. The function guci2get found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer...
SUSE CVE-2015-8972
Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess aka gnuchess before 6.2.4 might allow context-dependent attackers to execute arbitrary code via a large input, as demonstrated when in UCI mode...
TotoLink A3100R Command Injection Vulnerability (CNVD-2022-54652)
TotoLink A3100R is a series of wireless routers from TotoLink, Taiwan, China.TotoLink A3100R version V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 are vulnerable to command injection, which originates from uci cloudupdateconfig function in the magicid parameter fails to properly filter the...
PT-2022-19743 · Totolink · Totolink A3100R
Name of the Vulnerable Software and Affected Versions: TOTOLINK A3100R versions V4.1.2cu.5050 B20200504 through V4.1.2cu.5247 B20211129 Description: A command injection issue was discovered via the magicid parameter in the uci cloudupdate config function. This allows for potential exploitation...
closeup.ics.uci.edu Cross Site Scripting vulnerability OBB-2279574
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Security Advisory 2021-08-01-2 - Stored XSS in hostname UCI variable (CVE-2021-33425)
DESCRIPTION Multiple OpenWrt LuCI templates, including the one shipped by default, integrated the content of the UCI hostname variable without stripping it from malicious JavaScript. This allowed an attacker, which can control the content of the UCI hostname variable, to inject a arbitrary...
ics.uci.edu Improper Access Control vulnerability OBB-1234392
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2019-15513
An issue was discovered in OpenWrt libuci aka Library for the Unified Configuration Interface before 15.05.1 as used on Motorola CX2L MWR04L 1.01 and C1 MWR03 1.01 devices. /tmp/.uci/network locking is mishandled after reception of a long SetWanSettings command, leading to a device hang...
uci.es XSS vulnerability
Open Bug Bounty ID: OBB-702837 Description| Value ---|--- Affected Website:| uci.es Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...
apps.law.uci.edu XSS vulnerability
Open Bug Bounty ID: OBB-628380 Description| Value ---|--- Affected Website:| apps.law.uci.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Stack overflow
Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess aka gnuchess before 6.2.4 might allow context-dependent attackers to execute arbitrary code via a large input, as demonstrated when in UCI mode...
CVE-2015-8972
Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess aka gnuchess before 6.2.4 might allow context-dependent attackers to execute arbitrary code via a large input, as demonstrated when in UCI mode...
CVE-2015-8972
Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess aka gnuchess before 6.2.4 might allow context-dependent attackers to execute arbitrary code via a large input, as demonstrated when in UCI mode...
CVE-2015-8972
GNU Chess (gnuchess) is vulnerable to a stack-based buffer overflow in the ValidateMove function (frontend/move.cc) present in version 6.2.3 and earlier; a large input can allow context-dependent attackers to execute arbitrary code, notably when running in UCI mode. Public sources consistently st...
UCI KINOWELT Filme & Tickets - External URLs, SD-card access, Suspicious files vulnerabilities
HackApp vulnerability scanner discovered that application UCI KINOWELT Filme & Tickets published at the 'play' market has multiple vulnerabilities...
lib.uci.edu XSS vulnerability
Vulnerable URL: http://www.lib.uci.edu/collections/databases-a-to-z.html/"'; Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 23:29 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Googl...
CVE-2014-9212
Multiple cross-site scripting XSS vulnerabilities in Altitude uAgent in Altitude uCI Unified Customer Interaction 7.5 allow remote attackers to inject arbitrary web script or HTML via 1 an email hyperlink or the 2 style parameter in the image attribute section...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Altitude uAgent in Altitude uCI Unified Customer Interaction 7.5 allow remote attackers to inject arbitrary web script or HTML via 1 an email hyperlink or the 2 style parameter in the image attribute section...