6110 matches found
CLSA-2021-1632262269 Fix of CVE: CVE-2021-34693, CVE-2021-20292, CVE-2021-28972, CVE-2021-20265, CVE-2021-32399, CVE-2014-4508, CVE-2021-3612, CVE-2021-3178, CVE-2021-37159, CVE-2021-38205, CVE-2021-3573, CVE-2021-38160
ELSCVE-666: CVE-2021-34693: can: bcm: fix infoleak in struct bcmmsghead - ELSCVE-705: CVE-2021-38160: virtioconsole: Assure used length from device is limited - ELSCVE-769: CVE-2014-4508: x8632, entry: Do syscall exit work on badsys CVE-2014-4508 - ELSCVE-844: CVE-2021-3573: Bluetooth: use...
flac:fuzzer_decoder: Use-of-uninitialized-value in FLAC::Decoder::FuzzerStream::write_callback
Project: https://github.com/xiph/flac.git Detailed Report: https://oss-fuzz.com/testcase?key=6021284983603200 Project: flac Fuzzing Engine: libFuzzer Fuzz Target: fuzzerdecoder Job Type: libfuzzermsanflac Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...
Carefully add tokens to the list that the protocol uses
Handle tensors Vulnerability details Impact As of right now I believe the only outside tokens the protocol uses are DAI, USDC, USDT and WETH. If other tokens are added, make sure to check that they have no callbacks on transfer. For example, CREAM protocol added the AMP token which has a callback...
PT-2021-8177
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the clk component of the Linux kernel, where unbinding a CCU driver unmaps the device's MMIO region but leaves its clocks/resets and their providers registered...
Access restrictions on CompoundToNotionalV2.notionalCallback can be bypassed
Handle cmichel Vulnerability details Vulnerability Details The CompoundToNotionalV2.notionalCallback is supposed to only be called from the verified contract that calls this callback but the access restrictions can be circumvented by simply providing sender = this as sender is a parameter of the...
Access restrictions on NotionalV1ToNotionalV2.notionalCallback can be bypassed
Handle cmichel Vulnerability details Vulnerability Details The NotionalV1ToNotionalV2.notionalCallback is supposed to only be called from the verified contract that calls this callback but the access restrictions can be circumvented by simply providing sender = this as sender is a parameter of th...
.latestRoundData() does not update the oracle - ExchangeRate.sol
Handle tensors Vulnerability details Impact The method .latestRoundData on an oracle returns the latest updated price from the oracle, but this is not the current price of an asset. To get an accurate current price you need to query it by calling the oracle and waiting for a callback to fulfill t...
Possible reentrancy in balanceOf, decimals, mint
Handle tensors Vulnerability details Impact Registering tokens that aren't properly vetted can lead to a loss of funds if the token has callbacks. CREAM finance got hacked in a similar way because the ampleforth token had a callback in the transfer method that wasn't noticed when they vetted it...
CVE-2021-27910
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "errorrelatedto" parameters of the POST request of the bounce management callback will be permanently stored and execute...
CVE-2021-27910
CVE-2021-27910 describes a stored XSS in Mautic via the bounce management callback. The vulnerability arises from insufficient sanitization of the POST parameters error and error_related_to in the callback endpoint (POST /mailer//callback). An attacker with access to the callback can inject arbit...
CVE-2021-27910
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "errorrelatedto" parameters of the POST request of the bounce management callback will be permanently stored and execute...
CVE-2021-27910: Improper Neutralization of Input During Web Page Generation
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "errorrelatedto" parameters of the POST request of the bounce management callback will be permanently stored and execute...
PT-2021-17664
Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.4 Mautic versions prior to 4.0.0 Description: Insufficient sanitization/filtering allows for arbitrary JavaScript injection in Mautic using the bounce management callback function. An attacker can inject arbitrary...
Use after free in portaudio-rs
Affected versions of this crate is not panic safe within callback functions streamcallback and streamfinishedcallback. The call to user-provided closure might panic before a mem::forget call, which then causes a use after free that grants attacker to control the callback function pointer. This...
GHSA-QPJR-CH72-2QQ4 Use after free in portaudio-rs
Affected versions of this crate is not panic safe within callback functions streamcallback and streamfinishedcallback. The call to user-provided closure might panic before a mem::forget call, which then causes a use after free that grants attacker to control the callback function pointer. This...
PT-2021-3801 · Realtek · Realtek Jungle Sdk
Name of the Vulnerable Software and Affected Versions: Realtek Jungle SDK versions v2.x through v3.4.14B Description: The WiFi Simple Config server in the Realtek Jungle SDK is vulnerable due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header, leading to a stack buffer overflow...
pcl:ply_reader_fuzzer: Heap-buffer-overflow in void pcl::PLYReader::vertexListPropertyContentCallback<signed char>
Detailed Report: https://oss-fuzz.com/testcase?key=4540892542271488 Project: pcl Fuzzing Engine: afl Fuzz Target: plyreaderfuzzer Job Type: aflasanpcl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x60300002d388 Crash State: void...
PT-2021-16015
Name of the Vulnerable Software and Affected Versions Handsome Testimonials & Reviews WordPress plugin versions prior to 2.1.1 Description The issue arises from the hndtst action instance callback AJAX call in the Handsome Testimonials & Reviews WordPress plugin, which is accessible to any...
