Apple macOS security vulnerabilities

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. Apple macOS suffers from a security vulnerability that stems from the fact that users with physical access to the device may be able to use Siri to obtain some call log information. The following products and...

PT-2022-21540 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 16 macOS versions prior to Ventura 13 watchOS versions prior to 9 Description: A logic issue was addressed with improved state management. This issue allows a user with physical access to a device to potentially use Siri...

FAILED TRANSFER WITH LOW LEVEL CALL COULD BE OVERLOOKED

Lines of code Vulnerability details Impact There is possibility that failed transfer with low level call could be overlooked Proof of Concept Based on this Solidity official documentation Solidity The low-level functions call, delegatecall and staticcall return true as their first return value if...

Unused return _launchProjectFor

Lines of code Vulnerability details Impact the function will push the return value on the stack, the caller will then adjust the stack frame accordingly, but won't copy the returned value from the stack into any variable. ignores return value by Proof of Concept The execution of the message call...

Upgraded Q -> M from 921 [1666361310869]

Judge has assessed an item in Issue 921 as Medium risk. The relevant finding follows: 1. Should use call instead of transfer Line References GolomTrader.solL154 Impact The payableaddress.transfer function has a limit of 2300 gas source. If the receiver has a fallback/receive function that require...

Important: golang-github-gorilla-mux

Issue Overview: 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling,...

Upgraded Q -> M from 94 [1666365598508]

Judge has assessed an item in Issue 94 as Medium risk. The relevant finding follows: L-04 payEther should use .call instead of .transfer Use of .transfer is no longer encouraged, as it may fail if the receiver has any logic in their receive function, due to the 2300 gas consumption limit. --- The...

Upgraded Q -> M from 266 [1666361934775]

Judge has assessed an item in Issue 266 as Medium risk. The relevant finding follows: Stop Using Transfer Use call instead of transfer, as per. This does not introduce any issues for re-entrancy as all calling functions are marked non-reentrant. --- The text was updated successfully, but these...

CVE-2022-40889

Phpok 6.1 has a deserialization vulnerability via framework/phpokcall.php...

Cisco Expressway and Cisco

The vulnerability of Cisco Expressway microprogramming software and Cisco TelePresence Video Communication Server microprogramming software for call management devices is related to errors in the authentication process. Exploiting this vulnerability could allow a malicious actor to carry out a...

PHPOK code issues and vulnerabilities

PHPOK is an enterprise website builder with extension support. A security vulnerability exists in PHPOK version 6.1, which stems from a deserialization vulnerability found via framework/Phpokcall.php...

USN-5684-1 linux-azure vulnerabilities

It was discovered that the SUNRPC RDMA protocol implementation in the Linux kernel did not properly calculate the header size of a RPC message payload. A local attacker could use this to expose sensitive information kernel memory. CVE-2022-0812 Moshe Kol, Amit Klein and Yossi Gilad discovered tha...

CVE-2022-20464

In various functions of apinputprocessor.c, there is a possible way to record audio during a phone call due to a logic error in the code. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions...

Information disclosure

In various functions of apinputprocessor.c, there is a possible way to record audio during a phone call due to a logic error in the code. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions...

CVE-2022-20464

In various functions of apinputprocessor.c, there is a possible way to record audio during a phone call due to a logic error in the code. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions...

BlueHat 2023 Call for Papers is Now Open!

For nearly 20 years, BlueHat has been where the security research community, and Microsoft security professionals come together as peers, to share, debate, challenge, learn, and exchange ideas in the interest of creating a safer and more secure world for all. We are extremely excited to announce...

FUD-UUID-Shellcode - Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness

Introduction Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness :. How it works Shellcode generation Firstly, generate a payload in binary format using either CobaltStrike or msfvenom for instance, in...

BlueHat 2023 Call for Papers is Now Open!

For nearly 20 years, BlueHat has been where the security research community, and Microsoft security professionals come together as peers, to share, debate, challenge, learn, and exchange ideas in the interest of creating a safer and more secure world for all. We are extremely excited to announce...

BlueHat 2023 Call for Papers is Now Open!

For nearly 20 years, BlueHat has been where the security research community, and Microsoft security professionals come together as peers, to share, debate, challenge, learn, and exchange ideas in the interest of creating a safer and more secure world for all. We are extremely excited to announce...

CVE-2022-20413

In start of Threads.cpp, there is a possible way to record audio during a phone call due to a logic error in the code. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10...