CVE-2021-4210: Improper Input Validation

A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code...

Design/Logic Flaw

next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already...

CVE-2022-24858 Default redirect callback vulnerable to open redirects

next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already...

CVE-2022-24858 Default redirect callback vulnerable to open redirects

next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already...

CVE-2022-24858

The CVE-2022-24858 entry involves NextAuth.js open redirect vulnerability in the default redirect callback. Affected: next-auth before 3.29.2 and before 4.3.2. Root cause: lack of proper URL validation in the redirect callback, enabling malicious redirects. Impact: open redirects as described in ...

CVE-2022-1020

The Product Table for WooCommerce wooproducttable WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wptadminupdatenoticeoption AJAX action available to both unauthenticated and authenticated users, as well as does not validate the callback parameter, allowing...

Duplicate NFTs Can Be Minted if payableToken Has a Callback Attached to it

Lines of code Vulnerability details Impact The mintToken function is called to mint unique tokens from an ERC721 collection. This function will either require users to provide a merkle proof to claim an airdropped token or pay a fee in the form of a payableToken. However, because the payableToken...

No reentrancy guard on mint() function that has a callback

Lines of code Vulnerability details Impact the mint function calls mint which has a callback to the "to" address argument. Functions with callbacks should have reentrancy guards in place for protection against possible malicious actors both from inside and outside the protocol. Proof of Concept...

CVE-2022-28133

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create BitBucket Server consumers...

CVE-2022-28133

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create BitBucket Server consumers...

PT-2022-18831 · Jenkins · Jenkins Bitbucket Server Integration Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Bitbucket Server Integration Plugin versions 3.1.0 and earlier Description: The issue results from the plugin not limiting URL schemes for callback URLs on OAuth consumers, leading to a stored cross-site scripting XSS vulnerability...

CVE-2022-28133: Improper Neutralization of Input During Web Page Generation

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create BitBucket Server consumers...

Jenkins Bitbucket Server Integration Plugin 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier versions are...

Stored XSS vulnerability in atlassian-bitbucket-server-integration

atlassian-bitbucket-server-integration 2.0.0 through 3.1.0 inclusive does not limit URL schemes for callback URLs on OAuth consumers. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create BitBucket Server consumers...

SUSE-SU-2022:0857-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877. - Allow CRYPTOTHREADIDsetcallback to be called with NULL parameter bsc1196249...

Users Can Frontrun Token Distributions Using Flashloans

Lines of code Vulnerability details Impact The collector suite of contracts will actively send ANC token distributions to staked ANC token holders. However, because it is known beforehand that a distribution will be made to the governance contract, users can abuse this to frontrun distributions b...

GSD-2022-1000556 net/smc: Avoid overwriting the copies of clcsock callback functions

net/smc: Avoid overwriting the copies of clcsock callback functions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.11 by commit...

PT-2022-28743

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.15.22 through v5.15.24 Description The issue is related to overwriting copies of clcsock callback functions in the net/smc component. The actual impact and attack plausibility have not yet been proven. Recommendations...

PT-2022-28917

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10 through v5.16.5 Description A potential security issue exists due to an EOVERFLOW in the ipheth rcvbulk callback function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linu...

PT-2022-28830

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 5.16.8 through 5.16.10 Description The issue is related to overwriting copies of clcsock callback functions in the net/smc component. The actual impact and attack plausibility have not yet been proven. Recommendations For...