2974 matches found
GHSA-68P4-PJPF-XWCQ insert_slice_clone can double drop if Clone panics.
Affected versions of this crate used ptr::copy when inserting into the middle of a Vec. When ownership was temporarily duplicated during this copy, it calls the clone method of a user provided element. This issue can result in an element being double-freed if the clone call panics. Commit 20cb73d...
Predator Spyware Using Zero-day to Target Android Devices
By Deeba Ahmed Spyware developer firm Cytrox is under Googles radar for developing exploits against five 0-day flaws in Android and… This is a post from HackRead.com Read the original post: Predator Spyware Using Zero-day to Target Android Devices...
Cytrox's Predator Spyware Targeted Android Users with Zero-Day Exploits
Google's Threat Analysis Group TAG on Thursday pointed fingers at a North Macedonian spyware developer named Cytrox for developing exploits against five zero-day aka 0-day flaws, four in Chrome and one in Android, to target Android users. "The 0-day exploits were used alongside n-day exploits as...
openSUSE: Security Advisory for SDL2 (SUSE-SU-2022:1218-1)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2022-30012
In the POST request of the appointment.php page of HMS v.0, there are SQL injection vulnerabilities in multiple parameters, and database information can be obtained through injection...
Sql injection
In the POST request of the appointment.php page of HMS v.0, there are SQL injection vulnerabilities in multiple parameters, and database information can be obtained through injection...
CVE-2022-30012
In the POST request of the appointment.php page of HMS v.0, there are SQL injection vulnerabilities in multiple parameters, and database information can be obtained through injection...
CVE-2022-30012
The CVE-2022-30012 entry affects HMS v.0. In the POST request to appointment.php, multiple parameters expose SQL injection vulnerabilities that can disclose database information. The issue is documented across CVE/NVD entries and corroborated by CNVD/Red Hat/CNVD entries, all stating SQL injectio...
Improper Input Validation in Apache Qpid AMQP 0-x JMS
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...
Debian: Security Advisory (DSA-5135-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Microsoft Patch Tuesday: Fixes for 0-Day and 74 Other Flaws Released
By Waqas The latest edition of Patch Tuesday offers fixes for 7 critical flaws, including 5 RCE remote code execution… This is a post from HackRead.com Read the original post: Microsoft Patch Tuesday: Fixes for 0-Day and 74 Other Flaws Released...
CVE-2022-29975
An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0...
Spring4Shell-Poc - Spring Core RCE 0-day Vulnerability
Description of the vulnerability: https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html Construction of the POC: https://github.com/BobTheShoplifter/Spring4Shell-POC Steps to Build/Run Tested with JDK 11.0.14, Spring Boot 2.6.5, and Apache Tomcat 9.0.60 Run mvn clean packag...
SpeedBumpPriceGate.sol and FixedPricePassThruGate.sol should check whether gate.beneficiary is address(0)
Lines of code Vulnerability details Impact In SpeedBumpPriceGate\addGate and FixedPricePassThruGate\addGate, it doesn’t check whether gate.beneficiary is address0. Therefore, when doing passThruGate. ETH will be sent to address0. These ETH can never be taken back. Proof of Concept beneficiary can...
[SECURITY] Fedora 36 Update: stb-0^20210910gitaf1a5bc-0.2.fc36
Single-file public domain libraries for C/C++...
[SECURITY] Fedora 36 Update: golang-x-exp-0-0.42.20220330git053ad81.fc36
This subrepository holds experimental and deprecated packages. The idea for this subrepository originated as the pkg/exp directory of the ma in repository, but its presence there made it unavailable to users of the binary downloads of the Go installation. The subrepository has therefore been...
nav.2-0-2-2.inter-sys.funewa.com Cross Site Scripting vulnerability OBB-2565380
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-27925
Zimbra Collaboration aka ZCS 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal. Recent assessments: rbowes-r7 a...
The More You Know, The More You Know You Don’t Know
A Year in Review of 0-days Used In-the-Wild in 2021 Posted by Maddie Stone, Google Project Zero This is our third annual year in review of 0-days exploited in-the-wild 2020, 2019. Each year we’ve looked back at all of the detected and disclosed in-the-wild 0-days as a group and synthesized what w...
Setting the minter address to address(0) can lead to breaking the contract set.
Lines of code Vulnerability details Impact The highlighted issue can lead to breaking the functionality of the contract set. Proof of Concept At certain set functions in the codebase, we are allowing setting the values to address0 or the case where old address = new address. This was observed in...