Corporate Involvement in International Cybersecurity Treaties

The Paris Call for Trust and Stability in Cyberspace is an initiative launched by French President Emmanuel Macron during the 2018 UNESCO’s Internet Governance Forum. It’s an attempt by the worlds governments to come together and create a set of international norms and standards for a reliable,...

EulerOS 2.0 SP10 : bluez (EulerOS-SA-2022-1643)

According to the versions of the bluez package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a...

Usage of deprecated transfer to send ETH

Lines of code Vulnerability details Vulnerability details The usage of address.send is considered a bad practice as it only uses 2300 gas and you create a high dependency of gas. It is true that this is only used in an emergency to transfer the funds to the vault, but it always a better practice ...

EulerOS Virtualization 2.9.1 : bluez (EulerOS-SA-2022-1604)

According to the versions of the bluez package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus...

EulerOS Virtualization 2.9.0 : bluez (EulerOS-SA-2022-1627)

According to the versions of the bluez package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus...

CVE-2022-30292

Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sqreservestack call...

UBUNTU-CVE-2022-30292

Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sqreservestack call...

CVE-2022-30292

Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sqreservestack call...

GHSA-CQG4-RF29-3MV6 Trytond allows modification of privileges of arbitrary users

model/modelstorage.py in the Tryton application framework trytond before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a 1 create, 2 write, 3 delete, or 4 cop...

GHSA-694V-63FQ-FMR4 Path Traversal in scout-browser

Scout is a Variant Call Format VCF visualization interface. The Pypi package scout-browser is vulnerable to path traversal due to sendfile call in versions prior to 4.52...

PT-2025-8361

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version containing the commit b34ea31fe013 Description A vulnerability in the Linux kernel has been resolved. The issue was related to the iommu clock control in the mtk iommu remove function. After a specifi...

Squirrel buffer error vulnerability

squirrel is the stable version of the programming language SQUIRREL 3.2. A security vulnerability exists in squirrel version 3.2, which stems from the lack of a specific sqreservestack call to threadcall in sqbaselib.cpp. No detailed vulnerability details are currently available...

CVE-2022-1554 Path Traversal due to `send_file` call in clinical-genomics/scout

Path Traversal due to sendfile call in GitHub repository clinical-genomics/scout prior to 4.52...

PT-2022-3191 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue is related to the Advanced Local Procedure Call ALPC handler in Microsoft Windows operating systems, which is associated with inadequate access control. This can allow a...

Scout path traversal vulnerability

scout is analyzing VCF and collaborating to solve rare diseases faster. A security vulnerability exists in versions prior to scout version 4.52 that stems from an endfile call that can lead to path traversal...

PT-2022-13954

Name of the Vulnerable Software and Affected Versions clinical-genomics/scout versions prior to 4.52 Description The issue is related to a Path Traversal vulnerability due to a send file call in the clinical-genomics/scout GitHub repository. This vulnerability affects the Scout software, which is...

A week in security (April 25 – May 1)

Last week on Malwarebytes Labs: Why MITRE matters to SMBs Apple’s child safety features are coming to a Messages app near you Why software has so many vulnerabilities, with Tanya Janca: Lock and Code S03E09 Watch out for this SMS phish promising a tax refund Rogue ads phishing for cryptocurrency:...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-002)

The version of kernel installed on the remote host is prior to 5.4.110-54.182. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-002 advisory. 2024-09-12: CVE-2021-4442 was added to this advisory. An issue was discovered in the Linux kernel...

Google Android security vulnerabilities

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android, which stems from a placeCall in TelecomManager.java, where the application can keep itself running through foreground service importance due to a privilege bypass. The...

User can call liquidate() and steal all collateral due to arbitrary router call

Lines of code Vulnerability details Impact A malicious user is able to steal all collateral of an unhealthy position in PARMinerV2.sol. The code for the liquidate function is written so that the following steps are followed: User calls PARMinerV2.liquidate PARMinerV2 performs the liquidation with...