Information disclosure

In Telecomm, there is a possible way to get the call state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21378

In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21340

The CVE-2023-21340 entry describes an information-disclosure vulnerability in the Telecomm component of Android, caused by a missing permission check that allows local access to the call state without extra privileges or user interaction. Exploitation is local and does not require user action; CV...

USN-6458-1 slurm-llnl, slurm-wlm vulnerabilities

It was discovered that Slurm did not properly handle credential management, which could allow an unprivileged user to impersonate the SlurmUser account. An attacker could possibly use this issue to execute arbitrary code as the root user. CVE-2022-29500 It was discovered that Slurm did not proper...

CVE-2023-21340: Missing Authorization

In Telecomm, there is a possible way to get the call state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-18116 · Telecom · Telecom

Name of the Vulnerable Software and Affected Versions: Telecomm affected versions not specified Description: The issue in Telecomm allows for local information disclosure due to a missing permission check, which could provide access to the call state. This can be exploited without requiring...

CVE-2023-40130

In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and background activity launch with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-5051

CVE-2023-5051 affects CallRail Phone Call Tracking for WordPress. It is a Stored XSS via the callrail_form shortcode in versions ≤ 0.5.2 due to insufficient input sanitization and output escaping on the form_id attribute. Authenticated attackers with contributor+ permissions can inject scripts ex...

CVE-2023-5051: Improper Neutralization of Input During Web Page Generation

The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrailform' shortcode in versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on the 'formid' user supplied attribute. This makes it possible fo...

CVE-2023-34048

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution...

repayAllDebt joins system tokens to the proxy not to the Safe contract

Lines of code Vulnerability details Impact repayAllDebt now calls joinSystemCoins with dest = addressthis, which in case a proxy makes a delegated call to this function will cause the user's tokens to be transferred to its proxy, then in CoinJoin.join it will transfer internal coins from CoinJoin...

WordPress CallRail Phone Call Tracking Plugin <= 0.5.2 is vulnerable to Cross Site Scripting (XSS)

Software CallRail Phone Call Tracking Type Plugin Vulnerable versions = 0.5.2 Fixed in 0.5.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5051 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 24b6ce22a9c3 Credits István Márt...

CVE-2021-26737

The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to shutdown the Zscaler tunnel by exploiting a race condition...

Zscaler Client Connector Access Control Error Vulnerability

Zscaler Client Connector is an application from zscaler. An application installed on a device that ensures that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A security...

Samba RPC DoS

The vulnerability of the Samba networking communication server RPC server is related to the improper release of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

OESA-2023-1757 samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB...

OESA-2023-1756 samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB...

ConsoleFallbackHandler.sol#simulate transaction cannot simulate transaction properly

Lines of code Vulnerability details Impact ConsoleFallbackHandler.sol does not use static call or delegate call Proof of Concept In the function / @dev Performs a delegetecall on a targetContract in the context of self. Internally reverts execution to avoid side effects making it static. Catches...

CVE-2023-38546

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a functio...

Windows Procedure Call Information Disclosure

The vulnerability of the Remote Procedure Call component in the Windows operating system is related to the disclosure of information in the error data field. Exploiting this vulnerability can allow a remote attacker to disclose the protected information...