Author Archives: CERT

VU#905344: HTTP CONNECT and 407 Proxy Authentication Required messages are not integrity protected

Posted on by

HTTP CONNECT requests and 407 Proxy Authentication Required messages are not integrity protected and are susceptible to man-in-the-middle attacks. WebKit-based applications are additionally vulnerable to arbitrary HTML markup and JavaScript execution in the context of the originally requested domain. Continue reading VU#905344: HTTP CONNECT and 407 Proxy Authentication Required messages are not integrity protected→

VU#856152: NUUO and Netgear Network Video Recorder (NVR) products web interfaces contain multiple vulnerabilities

Posted on by

NUUO NVRmini 2,NVRsolo,Crystal,and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. Continue reading VU#856152: NUUO and Netgear Network Video Recorder (NVR) products web interfaces contain multiple vulnerabilities→

VU#974424: Crestron Electronics DM-TXRX-100-STR web interface contains multiple vulnerabilities

Posted on by

Crestron Electronics DM-TXRX-100-STR,version 1.2866.00026 and earlier,has a web management interface which contains multiple vulnerabilities,including authentication bypass,failure to restrict access to authorized users,use of hard-coded certificate,default credentials,and cross-site request forgery(CSRF). These vulnerabilities may be leveraged to gain complete control of affected devices. Continue reading VU#974424: Crestron Electronics DM-TXRX-100-STR web interface contains multiple vulnerabilities→

VU#217871: Intel CrossWalk project does not validate SSL certificates after first acceptance

Posted on by

The Intel Crosswalk project is a framework for developing hybrid apps for Android and iOS. The Crosswalk project does not properly handle SSL certificate validation when a user accepts an invalid certificate,preventing the app for validating any future SSL certificates. Continue reading VU#217871: Intel CrossWalk project does not validate SSL certificates after first acceptance→