“Free UK visa” offers on WhatsApp are fakes

A student friend recently shared a WhatsApp message, unsure if it was scam. The message claims to offer an easy to route to free visas, housing, accommodation, and medicine access. Heres how we know it was a scam, and where it lead. It read as follows: UK GOVERNMENT JOB RECRUITMENT 2022: This is...

GHSA-48HR-JG4P-W4P4 XSS vulnerability in Jenkins Claim Plugin

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name shown in claims. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside...

CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions 2.1.15, 2.2.9, and 2.3.4 which would allow unauthenticated users to impersonate as any Argo CD user or role, includin...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.3 in openshift-gitops-argocd container. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Anonymous NB65 Claims Hack on Russian Payment Processor Qiwi

By Waqas The Anonymous affiliated Network Battalion aka NB65 group has allegedly targeted a Russian payment processing platform Qiwi and… This is a post from HackRead.com Read the original post: Anonymous NB65 Claims Hack on Russian Payment Processor Qiwi...

Steer clear of these Instagram “Get rich with Bitcoin” scams

I don’t know about you, but I open Instagram to look at cool photos of pets, not to make a fortune via suspicious claims of riches by strangers. Despite this, following someone whose photos I liked resulted in a very peculiar message. It’s possible I waved goodbye to a path to untold riches. Mayb...

GHSA-XH97-72WW-2W58 Duplicate Advisory: Improper Verification of Cryptographic Signature in google-oauth-java-client

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hw42-3568-wj87. This link is maintained to preserve external references. Summary The vulnerability impacts only users of the IdTokenVerifier class. The verify method in IdTokenVerifier does not validate the...

Differing percentage denominators causes confusion and potentially brick claims

Lines of code Vulnerability details Details & Impact There is a PERCENTAGESCALE = 10e5 defined, but the actual denominator used is 10000. This is aggravated by the following factors: 1. Split contracts are created by collection owners, not the factory owner. Hence, there is a likelihood for someo...

Fee-on-Transfer tokens aren’t supported

Lines of code Vulnerability details Details & Impact Tokens that are charge a fee on transfer will not work correctly if it is specified as a payment token for NFT mints or as a royalty asset. For NFT mints, the amount recorded by the NewPayment and NewWithdrawal events might not match the actual...

Dnsmasq 2.86 has a heap-based buffer overflow in answer_request (called from FuzzAnswerTheRequest and fuzz_rfc1035.c). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities to the best of our knowledge.

...

Account compromise in Evmos

Impact What kind of vulnerability is it? Who is impacted? Classification The vulnerability has been classified as critical with a score of 9.0 highest. It has the potential to affect and drain unclaimed airdrop funds from Cosmos and Osmosis eligible user addresses. Disclosure The attack requires...

PT-2022-16840 · Cosmos +2 · Cosmos +2

Name of the Vulnerable Software and Affected Versions: Evmos versions prior to 2.0.1 Description: The issue allows attackers to drain unclaimed funds from user addresses by creating a new chain that does not enforce signature verification and connecting it to the target Evmos instance. The attack...

GHSA-CCXC-VR6P-4858 Improper Certificate Validation in Cosign

Impact Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and "keyless signing"...

SherlockClaimManager: Incorrect amounts needed and paid for escalated claims

Handle GreyArt Vulnerability details Impact When escalating claims, the documentation states that the protocol agent is required to pay and stake a certain amount for the process. If the covered protocol is proven correct, then the amount specified by the claim will be paid out. They will also...

startClaim() allows higher than covered amounts to submit claims

Handle GeekyLumberjack Vulnerability details Impact Allows claims that are higher than covered amounts. May cause unwanted results and confusion. Proof of Concept 1. Alice gets $100,000 in coverage 2. Alice changes coverage to $50,000 3. Alice call startClaim with amount set to $100,000 4. maxCla...

CVE-2022-21707 Incorrect Authorization in wasmCloud

wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly WASM actors and capability providers. In versions prior to 0.52.2 actors can bypass capability authorization. Actors are normally required to declare their capabilities for inbound invocations, b...

GO-2021-0258 Incorrect authorization in github.com/pomerium/pomerium

Pomerium is an open source identity-aware access proxy. Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowedidpclaims as part of policy. If using allowedidpclaims and a user's claims are changed, Pomerium can make incorrect authorizati...

Vault: onDepositMinted() reentrancy causes users’ deposits to be erroneously accounted as yield

Handle hickuphh3 Vulnerability details Impact The deposit function does not have reentrancy protection. This allows reentrancy to occur through the implementation of a malicious claim’s beneficiary onDepositMinted function that will cause all users’ deposits to be erroneously interpreted as yield...

Anybody can claim JLP tokens approved to WJLP

Handle kenzo Vulnerability details WJLP's wrap takes from and to as parameter, and doesn't check that msg.sender=from. This means that anybody can claim to himself tokens that a user approved for WJLP. Impact Loss of user funds. Proof of Concept The problem is in the wrap function. Code ref...

Security Bulletin: Vulnerability in Apache Log4j affects the components (Elastic Search and Hadoop) of IBM Financial Crimes Insight for Claims Fraud

Summary There is a vulnerability in the Apache Log4j open source library used by IBM Financial Crimes Insight for Claims Fraud for generating logs in some of its components. This bulletin provides mitigations for the Log4Shell vulnerability CVE-2021-44228 by applying the applicable workaround ste...