6045 matches found
CVE-2020-14114
information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information...
Xiaomi SmartHome APP 信息泄露漏洞
Xiaomi SmartHome APP is an app from Chinese company Xiaomi Xiaomi to manage Xiaomi smart home products. Xiaomi SmartHome APP suffers from an information leakage vulnerability, which originates from remote calls to some interfaces and can be exploited by attackers to obtain sensitive information...
Open-Xchange OX App Suite 安全特征问题漏洞
Open-Xchange OX App Suite is an email and productivity suite client software from Open-Xchange Germany. A security feature issue vulnerability exists in Open-Xchange OX App Suite versions prior to 7.10.6 that stems from a conflict that can change the parameters of an API request between OX App...
thenify before 3.3.1 made use of unsafe calls to `eval`.
Versions of thenify prior to 3.3.1 made use of unsafe calls to eval. Untrusted user input could thus lead to arbitrary code execution on the host. The patch in version 3.3.1 removes calls to eval...
CVE-2022-26479
An issue was discovered in Poly EagleEye Director II before 2.2.2.1. Existence of a certain file which can be created via an rsync backdoor causes all API calls to execute as admin without authentication...
PT-2022-10741 · Undertow · Undertow
Name of the Vulnerable Software and Affected Versions: Undertow versions prior to 2.2.15 Final Description: A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks...
Uncovering a macOS App Sandbox escape vulnerability: A deep dive into CVE-2022-26706
Microsoft uncovered a vulnerability in macOS that could allow specially crafted codes to escape the App Sandbox and run unrestricted on the system. We shared these findings with Apple through Coordinated Vulnerability Disclosure CVD via Microsoft Security Vulnerability Research MSVR in October...
DOS(Denial Of Service).External calls can fail accidentally or deliberately, which can cause a DoS condition in the contract.
Lines of code Vulnerability details Impact --Check: calls-loop --Severity: Medium --Confidence: Medium External calls can fail accidentally or deliberately, which can cause a DoS condition in the contract. There are two instances where this can occur. Proof of Concept -- --ConsenSys Smart...
Unchecked return value of transfer() and transferFrom()
Lines of code Vulnerability details Impact There are multiple external calls to IERC20.transfer and IERC20.transfer in contracts that suppose to transfer out tokens from/to the system. However, there are tokens like USDT that don't return any return value in their implementation of the transfer...
Reentrancy vulnerability due to _distributePayoutsOf
Lines of code Vulnerability details The function distributePayoutsOf has reentrancy vulnerability which is being called by the external function distributePayoutsOf There are external calls in this function along with calls sending ETH Impact The contract JBPayoutRedemptionPaymentTerminal inherit...
UBUNTU-CVE-2022-22677
A logic issue in the handling of concurrent media was addressed with improved state handling. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. Video self-preview in a webRTC call may be interrupted if the user answers a phone call...
django: Potential information disclosure in dictsort template filter
An information-disclosure flaw was found in Django, where the dictsort filter in Django's Template Language did not correctly validate user input. A network attacker could exploit this flaw using a suitably crafted key to force information disclosure or unintended method calls...
The vulnerability of the Windows operating system’s kernel allows attackers to enhance their privileges.
The vulnerability of the Windows operating system’s kernel is related to deficiencies in handling exceptional states during BIOS call processing. Exploiting this vulnerability can allow an attacker to enhance their privileges...
[H-02] Owner does not get any fee when call is expired
Lines of code Vulnerability details Owner\creators lose profit by not collecting the fees on half the expired cases all calls. The only place where owner receives fee is when withdrawing an exercised call or expired put: But when a call expired, no fee has been collected on any part of the order...
GSD-2022-1003483 NFSv4: Don't hold the layoutget locks across multiple RPC calls
NFSv4: Don't hold the layoutget locks across multiple RPC calls This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.122 by commit...
GSD-2022-1003226 NFSv4: Don't hold the layoutget locks across multiple RPC calls
NFSv4: Don't hold the layoutget locks across multiple RPC calls This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.47 by commit...
GSD-2022-1002560 NFSv4: Don't hold the layoutget locks across multiple RPC calls
NFSv4: Don't hold the layoutget locks across multiple RPC calls This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...
Wire Cross-Site Scripting Vulnerability (CNVD-2022-65920)
Wire is a chat software from the German company Wire. The software supports Web, WindowsiOS, Android, and OS X platforms, has group functionality, can make voice calls, send photos, and its original greeting method, PING. Wire has a cross-site scripting vulnerability that stems from insufficient...
Upgraded Q -> H from 215 [1656255310294]
Judge has assessed an item in Issue 215 as High risk. The relevant finding follows: L-09 wfCashERC4626 contract does not conform to EIP4626 Description The wfCashERC4626 contract implements the EIP4626 standard EIP-4626: Tokenized Vault Standard. However, according to EIP4626, the below-mentioned...