RLSA-2022:5311 Moderate: libgcrypt security update

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fixes: libgcrypt: ElGamal implementation allows plaintext recovery CVE-2021-40528 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

Motorola Solutions MDLC 加密问题漏洞

Motorola Solutions MDLC is a data communications protocol from Motorola Solutions. Motorola Solutions MDLC suffers from a cryptographic issue vulnerability that stems from MDLC's legacy encryption mode that encrypts traffic using a Tiny Encryption Algorithm TEA group cipher in ECB mode, which doe...

datarecovery.co.nz Cross Site Scripting vulnerability OBB-2681201

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Minting to user after funds deposit is now omitted in Lender's Swivel lend

Lines of code Vulnerability details Lender's Swivel version of lend pulls the underlying funds from the user, opens the necessary positions, but now fails to mint Illuminate PT for the user, so there will be no records for her investment and the corresponding funds aren't recoverable. Setting...

Critical address change

Lines of code Vulnerability details Impact Changing critical addresses in contracts should be a two-step process. in order to prevent changing admin by mistake Proof of Concept check these links: OpenZeppelin/openzeppelin-contracts1488 OpenZeppelin/openzeppelin-contracts2369 Tools Used Manual...

The vulnerability of the Apache Flume software for transmitting large volumes of streaming data lies in its memory-recovery mechanism for unreliable data. This vulnerability allows a hacker to execute arbitrary code.

The vulnerability of the Apache Flume software for transmitting large volumes of streaming data is related to the recovery of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of Trendnet TEW-831DR router microprogramming software, related to the lack of a password recovery mechanism, allows attackers to gain unauthorized access to protected information.

The vulnerability of Trendnet TEW-831DR router microprogramming software is related to the lack of a password recovery mechanism. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to protected information...

Malicious code in ps-cart-recovery (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2796fa288d4cdbb8c44fa760bce301d9f11d9f40f3707935733e2582b92244e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5500 Malicious code in ps-cart-recovery (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2796fa288d4cdbb8c44fa760bce301d9f11d9f40f3707935733e2582b92244e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-arm-recoveryservicesbackup-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9fb6fc132a3bd5da26027b683d1e5c343b71499551183bcebc7d60fc8d3e5bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mean_time_recovery (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9868d86d65bf9cee47652418fdb993413f0844bd54ed2b66ca87aa949e3c04bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-3323 · Metamask +2 · Metamask +2

Name of the Vulnerable Software and Affected Versions: MetaMask versions prior to 10.11.3 Description: The issue is related to the storage of confidential information in unencrypted form, allowing an attacker to access a user's secret recovery phrase. This is due to the use of an input field for ...

Rescue ETH at InfinityExchange.sol is incorrectly implemented

Lines of code Vulnerability details Impact Admins are unable to recover any ETH locked in the contract PoC The function rescueETHInfinityExchange.sol is incorrectly implemented. It is using msg.value instead of the balance of the contract function rescueETHaddress destination external payable...

The vulnerability of the Azure Site Recovery disaster recovery tool, related to insufficient validation of input data, allows a perpetrator to execute arbitrary code.

The vulnerability of the Azure Site Recovery recovery tool is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

The vulnerability of the Azure Site Recovery recovery tool allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Azure Site Recovery recovery tool is related to errors in information processing. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the Azure Site Recovery recovery tool lies in its ability to disclose information, allowing an intruder to gain unauthorized access to protected data.

The vulnerability of the Azure Site Recovery recovery mechanism is related to the exposure of information. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

HTML Injection

typo3/cms is vulnerable to HTML injection. The vulnerability exists due to the lack of sanitization used in the receiverName parameter in PasswordRecovery.html, allowing an attacker to inject and execute malicious html content on the web page...

WhiteBeam - Transparent Endpoint Security

Transparent endpoint security Features Block and detect advanced attacks Modern audited cryptography: RustCrypto for hashing and encryption Highly compatible: Development focused on all platforms incl. legacy and architectures Source available: Audits welcome Reviewed by security researchers with...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2022-60418)

IBM Spectrum Protect Plus is a data protection platform from IBM USA. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect Plus is vulnerable to an informati...

CVE-2021-3754

A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password. Mitigation The workaround is to enable "Email as username" flag ...