PT-2023-22039 · Trend Micro · Trend Micro Security

Name of the Vulnerable Software and Affected Versions: Trend Micro Security versions 2021 through 2023 Description: The issue allows an attacker to use a specific executable file as an execution and/or persistence mechanism, potentially executing a malicious program each time the executable file ...

Powerful JavaScript Dropper PindOS Distributes Bumblebee and IcedID Malware

A new strain of JavaScript dropper has been observed delivering next-stage payloads like Bumblebee and IcedID. Cybersecurity firm Deep Instinct is tracking the malware as PindOS , which contains the name in its "User-Agent" string. Both Bumblebee and IcedID serve as loaders, acting as a vector fo...

PT-2023-21535 · Dell · Dell Bios

Name of the Vulnerable Software and Affected Versions: Dell BIOS affected versions not specified Description: The issue is related to an improper authentication mechanism. A locally authenticated malicious user may potentially exploit this by bypassing certain authentication mechanisms to elevate...

Siemens Totally Integrated Automation Portal Protection Mechanism Failure Vulnerability

The Totally Integrated Automation Portal is a PC software that offers the full range of Siemens digital automation services, from digital planning and integrated engineering to transparent operation. A protection mechanism failure vulnerability exists in Siemens Totally Integrated Automation...

PT-2023-3210

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server versions prior to 16.0.10399.20005 Description This issue is an elevation of privilege vulnerability in Microsoft SharePoint Server that allows attackers to affect the system. The vulnerability enables remote...

Siemens TIA Portal 安全漏洞

The Totally Integrated Automation Portal is a PC software that offers the full range of Siemens digital automation services, from digital planning and integrated engineering to transparent operation. A protection mechanism failure vulnerability exists in Siemens Totally Integrated Automation...

The vulnerability of the TCP protocol implementation in the routing mechanism of Juniper Networks’ Junos OS allows a attacker to cause a service failure for the target device.

The vulnerability of the TCP protocol implementation in the routing mechanism of Juniper Networks’ Junos OS is related to incorrect handling of requests. Exploiting this vulnerability allows a malicious actor to cause a service failure for the target device by sending specially crafted data...

Oracle Linux 9 : grub2 (ELSA-2023-0752)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0752 advisory. - Fix CVE-2022-3775 Orabug: 34871953 - Resolves: CVE-2022-2601 Tenable has extracted the preceding description block directly from the Oracle Linux...

Exchange rate is stale for deposit to calculate shares

Lines of code Vulnerability details Impact The attacker can take profit with the delayed exchange rate updating mechanism. He can deposit to the protocol to take a share of large mev reward generated by the protocol before the exchange rate update. Proof of Concept The getExchangeRate function is...

Unauthorized Access and Control in Proxy Contract

Lines of code Vulnerability details Summary: The code contains a bug that can lead to unauthorized access and control over the contract. This bug allows any caller, even those who are not the owner or address0, to bypass the intended access control mechanisms and execute arbitrary code on the...

Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder

Impact A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mechanism offered by the Swift...

EulerOS Virtualization 2.11.0 : sqlite (EulerOS-SA-2023-2104)

According to the versions of the sqlite package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the...

GHSA-8VHC-HWHC-CPJ4 Rancher users retain access after moving namespaces into projects they don't have access to

Impact A vulnerability was identified in which users with update privileges on a namespace, can move that namespace into a project they don't have access to. After the namespace transfer is completed, their previous permissions are still preserved, which enables them to gain access to...

SUSE CVE-2023-34091

Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the deletionTimestamp field defined can bypass validate, generate, or mutate-existing policies, even in cases where the validationFailureAction field is set to Enforce. This situation...

New treasury rate should not affect existing loan

Lines of code Vulnerability details Impact In the protocol, lenders have to pay a small treasury fee when they claim their interest. The contract owner can change this treasuryRate at any time using the function setTreasuryRate. // @audit treasury rate should not affect existing loan function...

CVE-2023-0116

The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect availability...

CVE-2023-0116

CVE-2023-0116 affects Huawei HarmonyOS via the reminder module . The issue arises from processing unauthenticated broadcasts , with potential impact to availability as stated in multiple sources. Documents consistently cite a CVSS v3.1 base score 7.5 (NETWORK, LOW complexity, NONE privileges, HIG...

CVE-2023-0116

The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect availability...

CVE-2023-0116

The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect availability...

Recovery transaction can be replayed after a cancellation

Lines of code Vulnerability details Recovery transaction can be replayed after a cancellation The recovery transaction can be replayed after a cancellation of the recovery procedure, reinstating the recovery mechanism. Impact The Ambire wallet provides a recovery mechanism in which a privilege ca...