Design/Logic Flaw

Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting policy which then results in an flawed...

CVE-2023-42449 Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits

Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting policy which then results in an flawed...

CVE-2023-42449 Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits

Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting policy which then results in an flawed...

PT-2023-28349

Name of the Vulnerable Software and Affected Versions Hydra versions prior to 0.13.0 Description The issue arises from incorrect data validation logic in the head token minting policy, which results in a flawed check for burning the head ST in the initial validator. This is possible because it is...

PT-2023-27909 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions prior to 1.14.2 Cilium versions prior to 1.13.7 Cilium versions prior to 1.12.14 Description: In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with policy.cilium.io/proxy-visibility...

PT-2023-6853 · Moxa · Moxa Pt-G503 Series

Name of the Vulnerable Software and Affected Versions: Moxa PT-G503 Series firmware versions prior to v5.2 Description: The issue is related to the absence of the secure flag in session cookies, which could allow a remote attacker to gain unauthorized access to protected information. This may lea...

PT-2023-24486

Name of the Vulnerable Software and Affected Versions No vulnerable software or affected versions specified. Description The CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Recommendations At the moment, there is no information about a newer version that contains a fix for...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: Im speaking at swampUP 2023 in San Jose, California, on September 13, 2023 at 11:35 AM PT. The list is maintained on this page...

PT-2023-9901

Name of the Vulnerable Software and Affected Versions No information is available about the vulnerable software and its affected versions. Description The provided information does not contain details about the issue. It mentions that the candidate is unused by its CNA and refers to the National...

PT-2023-10458

Name of the Vulnerable Software and Affected Versions No information is available about the vulnerable software and its affected versions. Description The provided information does not contain details about the issue. It mentions that the candidate is unused by its CNA and refers to the National...

PT-2023-11212

Name of the Vulnerable Software and Affected Versions No information is available about the vulnerable software and its affected versions. Description The provided information does not contain details about the issue. It mentions that the candidate is unused by its CNA and refers to the National...

PT-2023-11199

Name of the Vulnerable Software and Affected Versions No information is available about the vulnerable software and its affected versions. Description The provided information does not contain details about the issue. Recommendations At the moment, there is no information about a newer version th...

PT-2023-5130 · Microsoft · Windows Miracast Wireless Display +1

Name of the Vulnerable Software and Affected Versions: Windows Miracast Wireless Display affected versions not specified Description: The vulnerability is related to insufficient input validation in the Windows Miracast Wireless Display adapter. It allows remote attackers to execute arbitrary cod...

PT-2023-27386

Name of the Vulnerable Software and Affected Versions No information available Description No details are provided about the issue. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2023-25255 · Google · Android

Name of the Vulnerable Software and Affected Versions: NotificationAccessSettings.java affected versions not specified Description: The issue is caused by a logic error in the code of NotificationAccessSettings.java, specifically in the updateList method. This error can lead to the hiding of...

PT-2023-27387

Name of the Vulnerable Software and Affected Versions No information available Description No details are provided about the issue. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2023-5890 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS affected versions not specified Description: The issue is related to the lack of authentication in the Open5GS implementation of the GTP protocol for mobile networks. This allows a remote attacker to send an HTTP request to an Open5GS...

CVE-2023-2813 Multiple Themes - Reflected XSS

All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2,...

CVE-2023-2813: Undefined Security Weakness

All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2,...

PT-2023-4591 · D Link · D-Link Dar-8000-10

Name of the Vulnerable Software and Affected Versions: D-Link DAR-8000-10 up to 20230809 Description: A critical issue affects the file /app/sys1.php, where the manipulation of the cmd argument with the input id leads to os command injection. This can be initiated remotely. The exploit has been...