17066 matches found
[ H ] In executeAction function, ETH can remain stuck after reverting due to a failed call.
Lines of code Vulnerability details Impact If and when the executeAction function reverts at either of the checks, the amount of ETH sent along with the call will be locked in the contract forever, with no current measures of recovery. Proof of Concept executeAction is called, but the call fails ...
PT-2023-3123 · Microsoft · Windows Server +1
Name of the Vulnerable Software and Affected Versions: Windows Server Service affected versions not specified Description: The issue is related to errors in security settings of the Windows Server operating system, allowing a remote attacker to bypass access checks to RPC procedures using a...
Microsoft Windows Remote Procedure Call Runtime security vulnerabilities
Microsoft Windows Remote Procedure Call Runtime is a powerful technology for creating distributed client/server programs from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Remote Procedure Call Runtime. An attacker could exploit this vulnerability to cause a deni...
PT-2023-3216 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient input validation in the Remote Procedure Call Runtime, which can lead to a denial-of-service condition. This can be exploited by a remote attacker to...
CVE-2023-29369: Integer Overflow or Wraparound
Remote Procedure Call Runtime Denial of Service Vulnerability...
CVE-2023-28933
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in StPeteDesign Call Now Accessibility Button plugin = 1.1 versions...
CVE-2023-28933
CVE-2023-28933 affects the WordPress plugin Call Now Accessibility Button by StPeteDesign, version
CVE-2023-28933: Improper Neutralization of Input During Web Page Generation
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in StPeteDesign Call Now Accessibility Button plugin = 1.1 versions...
PT-2023-22044 · Stpetedesign · Stpetedesign Call Now Accessibility Button
Name of the Vulnerable Software and Affected Versions: StPeteDesign Call Now Accessibility Button plugin versions = 1.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject...
WordPress Plugin StPeteDesign: "Call Now" accessibility button vulnerability due to cross-site scripting issues
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
UBUNTU-CVE-2023-32731
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this...
GRPC security vulnerabilities
gRPC is a modern, open-source, high-performance Remote Procedure Call RPC framework from gRPC Open Source. A security vulnerability exists in gRPC, which stems from the ability to call abort functions via http2...
PT-2023-18585
Name of the Vulnerable Software and Affected Versions WP Activity Log plugin for WordPress versions up to, and including, 4.5.0 Description The issue is related to a missing capability check on the handle ajax call function, allowing authenticated attackers with subscriber-level access or higher ...
(Pwn2Own) Western Digital MyCloud PR4100 do_reboot Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100 NAS devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within t...
(Pwn2Own) Western Digital MyCloud PR4100 account_mgr Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100 NAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the accountmgr cgi script. The issue results from t...
VMware Aria Operations for Networks createSupportBundle Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware Aria Operations for Networks. Authentication is not required to exploit this vulnerability. The specific flaw exists within the createSupportBundle method. The issue results from the lack of...
EulerOS Virtualization 2.11.1 : glibc (EulerOS-SA-2023-2069)
According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function...
(0Day) ZTE MF286R goahead Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ZTE MF286R routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of a request parameter provided to the SETDEVICELED endpoint. The...
CVE-2022-33227
CVE-2022-33227: Memory corruption in Linux-Android due to a double free when unregistering a provider after register. Affected component is Qualcomm GPS HLOS/Qualcomm chipsets under Android; root cause is a double free in the unregister path leading to memory corruption (impact: confidentiality, ...