Collaborate Disseminate
NUUO NVRmini 2,NVRsolo,Crystal,and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. Continue reading VU#856152: NUUO and Netgear Network Video Recorder (NVR) products web interfaces contain multiple vulnerabilities
The Crestron AirMedia AM-100 with firmware prior to version 1.4.0.13 is vulnerable to path traversal and command injection. Continue reading VU#603047: Crestron AirMedia AM-100 contains multiple vulnerabilities
Crestron Electronics DM-TXRX-100-STR,version 1.2866.00026 and earlier,has a web management interface which contains multiple vulnerabilities,including authentication bypass,failure to restrict access to authorized users,use of hard-coded certificate,default credentials,and cross-site request forgery(CSRF). These vulnerabilities may be leveraged to gain complete control of affected devices. Continue reading VU#974424: Crestron Electronics DM-TXRX-100-STR web interface contains multiple vulnerabilities
The Intel Crosswalk project is a framework for developing hybrid apps for Android and iOS. The Crosswalk project does not properly handle SSL certificate validation when a user accepts an invalid certificate,preventing the app for validating any future SSL certificates. Continue reading VU#217871: Intel CrossWalk project does not validate SSL certificates after first acceptance
Misys FusionCapital Opics Plus is used by regional and local financial institutions to manage treasuries. FusionCapital Opics Plus contains several vulnerabilities. Continue reading VU#682704: Misys FusionCapital Opics Plus contains multiple vulnerabilities
ASN.1 is a standard representation of data for networking and telecommunications applications. Objective System’s ASN1C compiler generates C and C++code that may be vulnerable to heap overflow. Continue reading VU#790839: Objective Systems ASN1C generates code that contains a heap overflow vulnerability
Web servers running in a CGI or CGI-like context may assign client request Proxy header values to internal HTTP_PROXY environment variables. This vulnerability can be leveraged to conduct man-in-the-middle(MITM)attacks on internal subrequests or to direct the server to initiate connections to arbitrary hosts. Continue reading VU#797896: CGI web servers assign Proxy header values from client requests to internal HTTP_PROXY environment variables
Accela Civic Platform Citizen Access portal contains cross-site scripting and arbitrary file upload vulnerabilities. Continue reading VU#665280: Accela Civic Platform Citizen Access portal contains multiple vulnerabilities
libbpg is a library for the BPG graphics format. libbpg 0.9.5 through 0.9.7 may allow a crafted file to write out-of-bounds,which may lead to denial of service or arbitrary code execution. Continue reading VU#123799: libbpg contains a type confusion vulnerability that leads to out of bounds write
The Acer Portal app for Android allows customers to connect to the Acer Cloud. The Acer Portal app,from version 3.9.3.2003 to 3.9.3.2006,does not properly validate SSL certificates when connecting to the Acer Cloud. Continue reading VU#690343: Acer Portal app for Android does not properly validate SSL certificates