CVE-2024-20802

Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users' notification in a multi-user environment...

Improper access control

Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users' notification in a multi-user environment...

CVE-2024-20802

Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users' notification in a multi-user environment...

CVE-2024-20802

Samsung DeX is affected by CVE-2024-20802 due to improper access control that allows the device owner to access other users’ notifications in a multi-user environment. Affected software: Samsung DeX prior to SMR Jan-2024 Release 1. Root cause: improper access control in the notification handling ...

CVE-2024-20802

Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users' notification in a multi-user environment...

PT-2024-18708 · Samsung · Samsung Dex

Name of the Vulnerable Software and Affected Versions: Samsung DeX versions prior to SMR Jan-2024 Release 1 Description: The issue is related to improper access control, allowing the owner to access other users' notifications in a multi-user environment. Recommendations: For versions prior to SMR...

SAMSUNG mobile devices security vulnerability

SAMSUNG mobile devices are a range of Samsung mobile devices, including cell phones, tablets, and more, from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG mobile devices SMR Jan-2024 Release 1 version and prior versions, which stems from an improper access...

Upgraded Q -> 2 from #37 [1703589922038]

Judge has assessed an item in Issue 37 as 2 risk. The relevant finding follows: L-02 openPosition maybe underflow in openPosition - Base.swap function openPosition DataStruct.OpenPositionParams calldata params public override nonReentrant returns uint96 lienId, uint256 collateralTo...

CVE-2022-39222

A flaw was found in Dex, an identity service that uses OpenID Connect to drive authentication for other apps. This issue may allow an attacker to make a victim navigate to a malicious website and guide them through the OIDC flow, stealing the OAuth authorization code in the process. The...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kube-oidc-proxy, slsa-verifier, k3d, kubeflow-fips, spark-operator, timestamp-authority-fips, aws-efs-csi-driver-fips, cortex, falcoctl-fips, kubeflow, dgraph, prometheus-blackbox-exporter, terraform-provider-sendgrid, prometheus-stackdriver-exporter,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: scorecard, cortex, kubescape, spark-operator, src, up, kubevela, k3d, dgraph, buildkitd, terraform-provider-sendgrid, prometheus-blackbox-exporter, kubeflow, aactl, slsa-verifier...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: hugo, ollama, oauth2-proxy, k3d, kubeflow-fips, kaf, kubernetes-csi-external-resizer, kubeflow, prometheus-alertmanager, dgraph, pulumi, flux-notification-controller, prometheus-blackbox-exporter, newrelic-infrastructure-agent, kubernetes-dashboard-metrics-scraper,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: hugo, ollama, oauth2-proxy, k3d, kubeflow-fips, kaf, kubernetes-csi-external-resizer, kubeflow, prometheus-alertmanager, dgraph, pulumi, flux-notification-controller, prometheus-blackbox-exporter, newrelic-infrastructure-agent, kubernetes-dashboard-metrics-scraper,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: hugo, ollama, oauth2-proxy, k3d, kubeflow-fips, kaf, cortex, kubeflow, dgraph, pulumi, flux-notification-controller, prometheus-blackbox-exporter, newrelic-infrastructure-agent, weaviate, tomcat, prometheus-elasticsearch-exporter, helm, ko, vault-csi-provider, kots,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, kind, aws-efs-csi-driver, cosign, rqlite, spark-operator, mc, dex, cortex, kubescape, kubeflow-katib, oauth2-proxy, secrets-store-csi-driver, secrets-store-csi-driver-provider-gcp, memcached-exporter, pulumi-language-java, stakater-reloader,...

Existing pools will be bricked due to uninitialized state

Lines of code Vulnerability details Existing pools will be bricked due to uninitialized Summary Pools already present in the exchange will be bricked when crossTicks is called with an uninitialized tickTracking storage, which will trigger an array out of bounds error. Impact New pools in the...

The Liquidity mining callpath sidecar owner can pull native tokens from the Dex

Lines of code Vulnerability details Impact The owner of liquidity mining sidecar can pull the native coins that are stored in the CrocSwapDex to reward the users. Proof of Concept The setConcRewards and setAmbRewards functions doesn't check if the quoted amount of rewards are actually sent by the...

A difference in the rDPX price between the oracle and DEXs used for trading can cause more slippage than expected

Lines of code Vulnerability details Impact The protocol will experience much higher slippage than supposed to due to using the wrong price in calculating the amount after slippage. Proof of Concept The protocol executes swaps on Uniswap and Curve. The issue arises due to the protocol using its ow...

CVE-2023-27648

Directory Traversal vulnerability found in T-ME Studios Change Color of Keypad v.1.275.1.277 allows a remote attacker to execute arbitrary code via the dex file in the internal storage...

Directory traversal

Directory Traversal vulnerability found in T-ME Studios Change Color of Keypad v.1.275.1.277 allows a remote attacker to execute arbitrary code via the dex file in the internal storage...