arbitrary send erc20 safeTransferFrom

Lines of code Vulnerability details Impact uses arbitrary from in safeTransferFrom when msg.sender is not used as from in safeTransferFrom. Proof of Concept Alice approves this contract to spend her ERC20 tokens. Bob can call a and specify Alice's address as the from parameter in safeTransferFrom...

sqlite: Out of bounds access during table rename

An out-of-bounds read vulnerability was found in SQLite. This security flaw occurs when the ALTER TABLE for views has a nested FROM clause. This flaw allows an attacker to triage an out-of-bounds read and access confidential data successfully...

CVE-2022-39342

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose model has a relation defined as a tupleset the right hand side of a ‘from’ statement that involves anything other than a direct relationship...

CVE-2022-39342: Improper Authorization

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose model has a relation defined as a tupleset the right hand side of a ‘from’ statement that involves anything other than a direct relationship...

CVE-2022-3626

LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemset in libtiff/tifunix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit...

CVE-2022-3598

LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b...

WordPress core <= 6.0.2 - Content From Multipart Emails Leak vulnerability

Content From Multipart Emails Leak vulnerability when HTML/plaintext used discovered by Thomas Kräftner in WordPress core versions = 6.0.2. Solution Update the WordPress WordPress wordpress to the latest available version at least 6.0.3...

UBUNTU-CVE-2022-2992

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint...

SUSE-SU-2022:0134-2 Security update for python-numpy

This update for python-numpy fixes the following issues: - CVE-2021-33430: Fixed buffer overflow that could lead to DoS in PyArrayNewFromDescrint function of ctors.c bsc1193913. - CVE-2021-41496: Fixed buffer overflow that could lead to DoS in arrayfrompyobj function of fortranobject.c bsc1193907...

CVE-2022-2884

A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint...

CVE-2022-2884: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint...

CVE-2022-2992: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint...

CVE-2022-2992

CVE-2022-2992 is a GitLab GitHub Import API deserialization flaw that enables authenticated users to trigger remote code execution. Affected products are GitLab CE/EE with versions 11.10–11.10.x? (per the wording) and all releases prior to 15.1.6, 15.2 up to 15.2.4, and 15.3 up to 15.3.2. The roo...

CVE-2022-2992

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint...

transferfrom with arbitrary from address allows attackers to receive tokens in L2 without paying

Lines of code Vulnerability details Impact In , the line token.transferFromfrom, escrow, amount; use an arbitrary from address. So an attacker can deposit victim's GTR token on L1, by using from address as victim's address, and receive equivalent tokens on L2 on attacker address. Proof of Concept...

CVE-2022-41528

creationtimestamp| type| source ---|---|--- 2022-10-07 09:07:46+00:00| seen| https://t.me/cibsecurity/50921...

maplefromcanada.co.uk Cross Site Scripting vulnerability OBB-2980976

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Upgraded Q -> M from 193 [1665109261242]

Judge has assessed an item in Issue 193 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

CVE-2022-41426

Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4AtomFactory::CreateAtomFromStream function in mp4split...

PT-2022-25863

Name of the Vulnerable Software and Affected Versions Bento4 version 1.6.0-639 Description A heap overflow issue was discovered in the AP4 Atom::TypeFromString function within the mp4tag component. Recommendations For Bento4 version 1.6.0-639, consider avoiding the use of the AP4...