Upgraded Q -> M from 91 [1667616172726]

Judge has assessed an item in Issue 91 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

CLSA-2022-1667513366 sqlite: Fix of CVE-2020-35527

CVE-2020-35527: fix a problem with ALTER TABLE for views that have a nested FROM clause...

CLSA-2022-1667513276 sqlite: Fix of CVE-2020-35527

CVE-2020-35527: fix a problem with ALTER TABLE for views that have a nested FROM clause...

pcs security update

0.9.169-3.0.1 - replace logo pcsd/public/favicon.ico in tarball - remove Source1 HAM-logo.png 0.9.169-3.el73.2 - Update rubygem rack - Upgrade jquery in web-ui - Resolves: rhbz2099578 rhbz2093232 0.9.169-3.el73.1 - Explicitly close libcurl connections to prevent stalled TCP connections in...

Transfer from does not make check for allowance size

Lines of code Vulnerability details Impact Transfer from does not make check for allowance size Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Add check to be sure that currentAllowance = amount is true --- The text was updated successfully, but these errors were...

arbitrary send erc20 safeTransferFrom

Lines of code Vulnerability details Impact uses arbitrary from in safeTransferFrom when msg.sender is not used as from in safeTransferFrom. Proof of Concept Alice approves this contract to spend her ERC20 tokens. Bob can call a and specify Alice's address as the from parameter in safeTransferFrom...

sqlite: Out of bounds access during table rename

An out-of-bounds read vulnerability was found in SQLite. This security flaw occurs when the ALTER TABLE for views has a nested FROM clause. This flaw allows an attacker to triage an out-of-bounds read and access confidential data successfully...

CVE-2022-3598

LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b...

CVE-2022-3626

LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemset in libtiff/tifunix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit...

WordPress core <= 6.0.2 - Content From Multipart Emails Leak vulnerability

Content From Multipart Emails Leak vulnerability when HTML/plaintext used discovered by Thomas Kräftner in WordPress core versions = 6.0.2. Solution Update the WordPress WordPress wordpress to the latest available version at least 6.0.3...

UBUNTU-CVE-2022-2992

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint...

SUSE-SU-2022:0134-2 Security update for python-numpy

This update for python-numpy fixes the following issues: - CVE-2021-33430: Fixed buffer overflow that could lead to DoS in PyArrayNewFromDescrint function of ctors.c bsc1193913. - CVE-2021-41496: Fixed buffer overflow that could lead to DoS in arrayfrompyobj function of fortranobject.c bsc1193907...

CVE-2022-2992

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint...

CVE-2022-2992

CVE-2022-2992 is a GitLab GitHub Import API deserialization flaw that enables authenticated users to trigger remote code execution. Affected products are GitLab CE/EE with versions 11.10–11.10.x? (per the wording) and all releases prior to 15.1.6, 15.2 up to 15.2.4, and 15.3 up to 15.3.2. The roo...

transferfrom with arbitrary from address allows attackers to receive tokens in L2 without paying

Lines of code Vulnerability details Impact In , the line token.transferFromfrom, escrow, amount; use an arbitrary from address. So an attacker can deposit victim's GTR token on L1, by using from address as victim's address, and receive equivalent tokens on L2 on attacker address. Proof of Concept...

CVE-2022-41528

creationtimestamp| type| source ---|---|--- 2022-10-07 09:07:46+00:00| seen| https://t.me/cibsecurity/50921...

maplefromcanada.co.uk Cross Site Scripting vulnerability OBB-2980976

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Upgraded Q -> M from 193 [1665109261242]

Judge has assessed an item in Issue 193 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

CVE-2022-41426

Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4AtomFactory::CreateAtomFromStream function in mp4split...

Google Pixel 安全漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability. No information about this vulnerability is available at this time, so stay tuned to CNNVD or the manufacturer's announcement...