MAL-2023-725 Malicious code in react-liveness (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47194814149429b2ad255dd7af25f5f896c60db91a66c27a1e0ab4ebf077bde1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Lack of checks for non-zero values

Lines of code Vulnerability details Impact Lack of propper parameter validation Proof of Concept The GetPoolByLptDenom function takes lptDenom as an input parameter and uses it right away as an argument to retrieve a pool from the KVStore. However, if it is empty or invalid, the function will...

Lack of input validation

Lines of code Vulnerability details Impact There is no input sanitizer implemented for the transfertypes.FungibleTokenPacketData data variable. Proof of Concept After "unmarshaling" the packet, which checks if there is an error, it is used right away without further checking the fields inside it,...

GHSA-G753-GHR7-Q33W cyfs-base vulnerable to misaligned pointer dereference in `ChunkId::new`

The function ChunkId::new creates a misaligned pointer by casting mutable pointer of u8 slice which has alignment 1 to the mutable pointer of u32 which has alignment 4, and dereference the misaligned pointer leading UB, which should not be allowed in safe function...

MAL-2023-1344 Malicious code in wm-webpack-player-sri (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ce8f86b27a02853a91d351ebf67ea4c8b697d62b1c65c295b7a01cfa89148ec The OpenSSF Package Analysis project identified 'wm-webpack-player-sri' @ 0.0.71 npm as malicious. It is considered malicious because: - The...

GHSA-WFG4-322G-9VQV memoffset allows reading uninitialized memory

memoffset allows attempt of reading data from address 0 with arbitrary type. This behavior is an undefined behavior because address 0 to std::mem::sizeof may not have valid bit-pattern with T. Old implementation dereferences uninitialized memory obtained from std::mem::alignof. Older implementati...

memoffset allows reading uninitialized memory

memoffset allows attempt of reading data from address 0 with arbitrary type. This behavior is an undefined behavior because address 0 to std::mem::sizeof may not have valid bit-pattern with T. Old implementation dereferences uninitialized memory obtained from std::mem::alignof. Older implementati...

RUSTSEC-2023-0045 memoffset allows reading uninitialized memory

memoffset allows attempt of reading data from address 0 with arbitrary type. This behavior is an undefined behavior because address 0 to std::mem::sizeof may not have valid bit-pattern with T. Old implementation dereferences uninitialized memory obtained from std::mem::alignof. Older implementati...

memoffset allows reading uninitialized memory

memoffset allows attempt of reading data from address 0 with arbitrary type. This behavior is an undefined behavior because address 0 to std::mem::sizeof may not have valid bit-pattern with T. Old implementation dereferences uninitialized memory obtained from std::mem::alignof. Older implementati...

Insufficient Validation of Addresses Vulnerability

Lines of code Vulnerability details Summary The code suffers from an insufficient validation of addresses vulnerability. Although it uses the sdk.AccAddressFromBech32 function to convert addresses from Bech32 format to sdk.AccAddress, it fails to validate the addresses for their validity and...

CVE-2023-34161

nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability may cause features to perform abnormally...

CVE-2023-25736

An invalid downcast from nsHTMLDocument to nsIContent could have lead to undefined behavior. This vulnerability affects Firefox 110...

Code injection

An invalid downcast from nsHTMLDocument to nsIContent could have lead to undefined behavior. This vulnerability affects Firefox 110...

CVE-2023-25736

An invalid downcast from "nsHTMLDocument" to "nsIContent" could have lead to undefined behavior. This vulnerability affects Firefox 110...

CVE-2023-25736

An invalid downcast from nsHTMLDocument to nsIContent could have lead to undefined behavior. This vulnerability affects Firefox 110...

CVE-2023-25736

An invalid downcast from nsHTMLDocument to nsIContent could have lead to undefined behavior. This vulnerability affects Firefox 110...

CVE-2023-25736

An invalid downcast from nsHTMLDocument to nsIContent could have lead to undefined behavior. This vulnerability affects Firefox 110...

Published Explorer.exe and other applications close instantly after launch

When a published application such as Explorer is started, it closes instantly. Please note: this can also apply to many other applications that exhibit this behavior and not excluded to just explorer.exe. This is a built-in timer in Terminal Services which dictates if a session is not fully...

CVE-2023-25736: Undefined Security Weakness

An invalid downcast from nsHTMLDocument to nsIContent could have lead to undefined behavior. This vulnerability affects Firefox 110...

CVE-2023-34163: Undefined Security Weakness

Permission control vulnerability in the window management module.Successful exploitation of this vulnerability may cause features to perform abnormally...