Possible reentrancy in balanceOf, decimals, mint

Handle tensors Vulnerability details Impact Registering tokens that aren't properly vetted can lead to a loss of funds if the token has callbacks. CREAM finance got hacked in a similar way because the ampleforth token had a callback in the transfer method that wasn't noticed when they vetted it...

CVE-2021-27910

Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "errorrelatedto" parameters of the POST request of the bounce management callback will be permanently stored and execute...

CVE-2021-27910

CVE-2021-27910 describes a stored XSS in Mautic via the bounce management callback. The vulnerability arises from insufficient sanitization of the POST parameters error and error_related_to in the callback endpoint (POST /mailer//callback). An attacker with access to the callback can inject arbit...

CVE-2021-27910

Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "errorrelatedto" parameters of the POST request of the bounce management callback will be permanently stored and execute...

CVE-2021-27910: Improper Neutralization of Input During Web Page Generation

Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "errorrelatedto" parameters of the POST request of the bounce management callback will be permanently stored and execute...

PT-2021-17664

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.4 Mautic versions prior to 4.0.0 Description: Insufficient sanitization/filtering allows for arbitrary JavaScript injection in Mautic using the bounce management callback function. An attacker can inject arbitrary...

Use after free in portaudio-rs

Affected versions of this crate is not panic safe within callback functions streamcallback and streamfinishedcallback. The call to user-provided closure might panic before a mem::forget call, which then causes a use after free that grants attacker to control the callback function pointer. This...

GHSA-QPJR-CH72-2QQ4 Use after free in portaudio-rs

Affected versions of this crate is not panic safe within callback functions streamcallback and streamfinishedcallback. The call to user-provided closure might panic before a mem::forget call, which then causes a use after free that grants attacker to control the callback function pointer. This...

PT-2021-3801 · Realtek · Realtek Jungle Sdk

Name of the Vulnerable Software and Affected Versions: Realtek Jungle SDK versions v2.x through v3.4.14B Description: The WiFi Simple Config server in the Realtek Jungle SDK is vulnerable due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header, leading to a stack buffer overflow...

pcl:ply_reader_fuzzer: Heap-buffer-overflow in void pcl::PLYReader::vertexListPropertyContentCallback<signed char>

Detailed Report: https://oss-fuzz.com/testcase?key=4540892542271488 Project: pcl Fuzzing Engine: afl Fuzz Target: plyreaderfuzzer Job Type: aflasanpcl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x60300002d388 Crash State: void...

PT-2021-16015

Name of the Vulnerable Software and Affected Versions Handsome Testimonials & Reviews WordPress plugin versions prior to 2.1.1 Description The issue arises from the hndtst action instance callback AJAX call in the Handsome Testimonials & Reviews WordPress plugin, which is accessible to any...

CVE-2021-3452

A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2021-3452

A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code...

PT-2021-20533

Name of the Vulnerable Software and Affected Versions: ThinkPad models affected versions not specified Description: A potential issue in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2021-3452: Improper Input Validation

A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code...

Lenovo Bios 授权问题漏洞

Lenovo Bios is a boot method for computers from the Chinese company Lenovo Lenovo. It is used to boot the system during computer startup. Lenovo BIOS has an authorization issue vulnerability that stems from a lack of privilege control in the system shutdown SMI callback function, which allows an...

VDZ CallBack < 1.14.6 - Authenticated Stored XSS

The plugin does not properly sanitise or escape some of its settings, allowing high privilege users such as admin to perform XSS attacks even when the unfilteredhtml capability is disallowed Put the following payload in the Title setting of the plugin...

VDZ CallBack < 1.14.6 - Authenticated Stored XSS

The plugin does not properly sanitise or escape some of its settings, allowing high privilege users such as admin to perform XSS attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the Title setting of the plugin...

sleuthkit:sleuthkit_fls_hfs_fuzzer: Heap-buffer-overflow in hfs_dir_open_meta_cb

Project: https://github.com/sleuthkit/sleuthkit.git Detailed Report: https://oss-fuzz.com/testcase?key=5725002489004032 Project: sleuthkit Fuzzing Engine: afl Fuzz Target: sleuthkitflshfsfuzzer Job Type: aflasansleuthkit Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

The vulnerability of the `cp_plugins_do_button_job_later_callback` function in the Tree Sitemap WordPress plugin allows a hacker to execute arbitrary code.

The vulnerability of the cppluginsdobuttonjoblatercallback function in the Tree Sitemap WordPress plugin is related to authentication process errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...