PT-2022-17720 · Marky · Marky

Name of the Vulnerable Software and Affected Versions: Marky commit 3686565726c65756e Description: The issue is related to a remote code execution RCE vulnerability. It allows attackers to execute arbitrary code via injection of a crafted payload through the Display text fields. Recommendations:...

PT-2022-17291 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda AC9 version 15.03.2.21 Description: A stack overflow issue was discovered in the SetVirtualServerCfg function via the list parameter. Recommendations: For Tenda AC9 version 15.03.2.21, consider restricting access to the...

CVE-2021-39709

In sendSipAccountsRemovedNotification of SipAccountRegistry.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

[WP-H4] anchor_basset_reward pending yields can be stolen

Lines of code Vulnerability details For yield farming aggregators, if the pending yield on an underlying strategy can be harvested and cause a surge of rewards to all existing investors, especially if the harvest can be triggered permissionlessly. Then the attacker can amplify the attack using a...

Denial of Service in Go-Ethereum

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and th...

CVE-2022-23328

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and th...

CVE-2022-23328

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and th...

CVE-2022-23328

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and th...

PT-2022-15930

Name of the Vulnerable Software and Affected Versions Go-Ethereum versions 1.10.12 and older Description A design flaw allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing...

Loss of pending messages (if any) in case removeConnectedChain is called

Lines of code Vulnerability details Impact If there are any unprocessed messages to be executed or processed, while removeConnectedChain is called, then they may be stuck from getting processed on the other end. If these messages have transactions for any token transfer then it will get stuck or...

PT-2022-7614 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to commit 5e70bc8 Description: The vulnerability is related to the btrfs file system in the Linux kernel. It occurs when a pending balance is waiting to get the cleaner mutex, and a snapshot deletion is running, an...

CVE-2022-219862

CVE-2022-219862 corresponds to a vulnerability in ASP.NET Core related to HTTP headers pooling that can lead to a denial of service. Connected advisories show affected packages across multiple Linux distributions: MiracleLinux 8: dotnet5.0-5.0.211-1.el8.ML.1 (AXSA:2022-3061:07) — specific package...

Issues with removing a connected chain

Lines of code Vulnerability details Impact A connected chain can be removed which will make all pending messages fail. If the chain is reinitialized again at some point, its incomingMessageCounter will start at zero and allow replay attacks of all previous messages. function...

GSD-2022-1000200 powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending

powerpc/perf: Fix powerpmudisable to call clearpmiirqpending only if PMI is pending This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.96 by...

PT-2022-7430 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the ocelot vlan del function in the Linux kernel's Microsemi network adapter driver, which is vulnerable to a use-after-free condition. This occurs because ocel...

CVE-2022-24000

PendingIntent hijacking vulnerability in DataUsageReminderReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permission in KnoxPrivacyNoticeReceiver via implicit Intent...

CVE-2022-24000

PendingIntent hijacking vulnerability in DataUsageReminderReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permission in KnoxPrivacyNoticeReceiver via implicit Intent...

CVE-2022-23434

A vulnerability using PendingIntent in Bixby Vision prior to versions 3.7.60.8 in Android S12, 3.7.50.6 in Andorid R11 and below allows attackers to execute privileged action by hijacking and modifying the intent...

Samsung DeX Home 代码注入漏洞

Samsung DeX Home is a Samsung DeX application for PC and Mac from Samsung South Korea. A security vulnerability exists in Samsung DeX Home that stems from a PendingIntent attack in the software, which allows an attacker to access files using system privileges...

Samsung KnoxPrivacyNoticeReceiver 输入验证错误漏洞

Samsung SettingsReceiver is a component in Samsung Samsung mobile devices. Samsung SettingsReceiver suffers from a PendingIntent hijacking vulnerability that originates from unauthorized access in SettingsReceiver, which can be exploited by a local attacker to gain unauthorized access to media...