5921 matches found
Oracle price could not be fresh
Lines of code Vulnerability details Vulnerability In FraxlendPairCore.updateExchangeRate, we are using latestRoundData, but there are no validations that the data is not stale. The current code is: , int256 answer, , , = AggregatorV3InterfaceoracleMultiply.latestRoundData; if answer = round, "Sta...
Chainlink's latestRoundData() might return stale or incorrect data
Lines of code Vulnerability details Impact The only value being checked from the return of latestRoundData is answer. Chainlink will return more fields that can be checked to ensure the data is not stale/incorrect. Proof of Concept Lack of checks inside the function updateExchangeRate might cause...
Affiliates Manager < 2.9.14 - Affiliate CSV Injection
The plugin does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data PoC Register as an affiliate and put the following payload in the Firstname, Lastname or Company fields: =10+2+30 As...
The vulnerability of the Office Online Server web server, related to insufficient validation of input data, allows attackers to execute arbitrary code.
The vulnerability of the Office Online Server web server is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code on the target system...
GLSA-202208-25 : Chromium, Google Chrome, Microsoft Edge, QtWebEngine: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202208-25 Chromium, Google Chrome, Microsoft Edge, QtWebEngine: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Chromium and its derivatives. Please review the CVE identifiers referenced below for details...
USN-5566-1: Linux kernel vulnerabilities
Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service system crash or execute arbitrary code...
The vulnerability of Google Chrome and Microsoft Edge browsers, related to insufficient validation of input data, allows attackers to disclose protected information.
The vulnerability of Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...
Emerson ControlWave 数据伪造问题漏洞
Emerson ControlWave is a highly programmable controller from Emerson Electric U.S. that combines the unique capabilities of a Programmable Logic Controller PLC and a Remote Terminal Unit RTU into a hybrid controller. A data forgery vulnerability exists in all versions of Emerson ControlWave, whic...
Add members to the not yet created community
Lines of code Vulnerability details Impact There is a addMember function in the Community. The function accepts data that should be signed by the community.owner and newMemberAddr. // Compute hash from bytes bytes32 hash = keccak256data; // Decode params from data uint256 communityID, address...
Shopware Cross-Site Scripting Vulnerability (CNVD-2022-56128)
Shopware is a set of open source e-commerce software from the German company Shopware.Shopware suffers from a cross-site scripting vulnerability, which stems from a lack of data validation filtering of user-supplied data and output in the client module. An attacker could exploit the vulnerability...
IBM DataPower Gateway Cross-Site Scripting Vulnerability (CNVD-2022-56972)
IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B, and cloud workloads. The platform protects, integrates, and optimizes access across channe...
CVE-2022-28668
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.9.2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Design/Logic Flaw
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.9.2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2022-28684
CVE-2022-28684 describes a remote code execution via deserialization in DevExpress SafeBinaryFormatter. Exploitation requires authentication; impact is high (C Confidentiality/Integrity/Availability). Affected: IBM Robotic Process Automation < 21.0.4 and IBM Robotic Process Automation for Clou...
Ubuntu: Security Advisory (USN-5544-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-5545-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-5545-1: Linux kernel (OEM) vulnerability
Arthur Mongodin discovered that the netfilter subsystem in the Linux kernel did not properly perform data validation. A local attacker could use this to escalate privileges in certain situations...
USN-5545-1 linux-oem-5.14, linux-oem-5.17 vulnerability
Arthur Mongodin discovered that the netfilter subsystem in the Linux kernel did not properly perform data validation. A local attacker could use this to escalate privileges in certain situations...
Webmin Cross-Site Scripting Vulnerability (CNVD-2022-54893)
A cross-site scripting vulnerability exists in Webmin, the Webmin community's Web-based system administration tool for Unix-like operating systems, due to a lack of data validation filtering of user-supplied and output data in the Read Mail module. An attacker could use this vulnerability to crea...
