11288 matches found
rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code...
rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code...
Exchange Backup Jobs Warning "Failed to find group owner account"
Challenge Backup jobs with Microsoft Exchange items may result in the warning message shown in both the Veeam Backup for Microsoft 365 console and the Veeam.Archiver.Proxy.log file. Processing mailbox $mailboxName completed with warning: Failed to find group owner account This appears in the...
Privilege Escalation
github.com/rancher/rancher is vulnerable to privilege escalation. The vulnerability exists due to improperly enforced APIgroup rules, allowing a project owner with permissions to edit role bindings to allocate a cluster level role to grant themselves or others an admin role to that cluster...
Huawei Mate 20 Improper Authentication Vulnerability
Huawei Mate 20 is a smartphone from Chinese company Huawei Huawei. An authorization issue vulnerability exists in previous versions of Huawei Mate 20 9.1.0.139 C00E133R3P1, which stems from a logic error that sometimes occurs in the system. An attacker can exploit the vulnerability with the help ...
Cryptbond Network Override Vulnerability
Cryptbond Network CBN is a cryptocurrency. An override vulnerability exists in the 'ToOwner' function in the smart contract implementation of Cryptbond Network CBN, which stems from the fact that the function does not check the identity of the caller. An attacker could use the vulnerability to...
Business Alliance Financial Circle (BAFC) Overreach Vulnerability
Business Alliance Financial Circle BAFC is a cryptocurrency. The 'UBSexToken' function in BAFC's smart contract implementation is vulnerable to an overreach vulnerability that stems from the fact that the function is publicly available and does not check the identity of the caller. An attacker...
BOMBBA Override Vulnerability
BOMBBA BOMB is a cryptocurrency. BOMBBA BOMB has an override vulnerability in the 'quaker' function in its smart contract implementation, which stems from the function's failure to check the identity of the caller. An attacker could use the vulnerability to modify the owner of the smart contract...
CVE-2018-19830
The UBSexToken function of a smart contract implementation for Business Alliance Financial Circle BAFC, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public by default and does not check the caller's identity...
CVE-2018-19834
The quaker function of a smart contract implementation for BOMBBA BOMB, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...
Code injection
The ToOwner function of a smart contract implementation for Cryptbond Network CBN, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...
CVE-2018-19831
CVE-2018-19831 describes a permission issue in the Cryptbond Network (CBN) smart contract: the ToOwner() function does not validate the caller, enabling an attacker to modify the contract owner. Connected CNVD entries (CNVD-2020-43491 and CNVD-2020-43490) corroborate an authorization/overreach vu...
CVE-2018-19830
The UBSexToken function of a smart contract implementation for Business Alliance Financial Circle BAFC, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public by default and does not check the caller's identity...
CVE-2018-19834
The CVE-2018-19834 entry concerns a vulnerability in the smart contract quaker function that allows an attacker to change the contract owner due to lack of caller identity checks. Connected documents describe a recurring pattern across multiple ERC20-like contracts (e.g., BAFC, CBN, NETM, DDQ) wh...
CVE-2018-19834
The quaker function of a smart contract implementation for BOMBBA BOMB, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...
kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members
A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows local users to create files with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group an...
kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members
A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows local users to create files with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group an...
Stripo Inc: Improper Authorization
hi there , i found an vulnerability on https://my.stripo.email/cabinet//users/orogid , generally every user have an organisation and the organisation contain projects , lets suppose : [email protected] is the owner of the project and [email protected] was invited to his project as admin , in normal...
The vulnerability of the components lib/rubygems/commands/owner_command.rb and test/rubygems/test_gem_commands_owner_command.rb of the RubyGems package management system allows a hacker to execute arbitrary code.
The vulnerability in the components lib/rubygems/commands/ownercommand.rb and test/rubygems/testgemcommandsownercommand.rb of the RubyGems package management system is related to the restoration of unreliable data in memory. Exploiting this vulnerability could allow an attacker to execute arbitra...