CVE-2023-36160

An issue was discovered in Qubo Smart Plug10A version HSP02010114SYSTEM-10 A, allows local attackers to gain sensitive information and other unspecified impact via UART console...

Qubo Smart Plug Security Vulnerability

Qubo Smart Plug is a smart plug from Qubo. It effectively manages and tracks the energy consumption of devices through real-time power monitoring. A security vulnerability exists in Qubo Smart Plug version 10A HSP02010114SYSTEM-10 A. The vulnerability stems from a vulnerability that allows an...

PT-2023-21848 · Unknown · Freewill Ifis

Name of the Vulnerable Software and Affected Versions: Freewill iFIS aka SMART Trade version 20.01.01.04 Description: The issue allows OS Command Injection via shell metacharacters to a report page. Recommendations: For Freewill iFIS aka SMART Trade version 20.01.01.04, consider restricting acces...

CVE-2023-36160

An issue was discovered in Qubo Smart Plug10A version HSP02010114SYSTEM-10 A, allows local attackers to gain sensitive information and other unspecified impact via UART console...

PT-2023-25460 · Unknown · Qubo Smart Plug 10A

Name of the Vulnerable Software and Affected Versions: Qubo Smart Plug10A version HSP02 01 01 14 SYSTEM-10 A Description: An issue was discovered in Qubo Smart Plug10A, allowing local attackers to gain sensitive information and other unspecified impact via UART console. Recommendations: For Qubo...

CVE-2023-36160

CVE-2023-36160 affects Qubo Smart Plug10A, specifically version HSP02_01_01_14_SYSTEM-10 A. The issue permits local attackers to access sensitive information via the UART console, with the exposed impact limited to confidentiality (as per the CVSS and vendor notes) and without other confirmed exp...

CVE-2023-28614

CVE-2023-28614 affects Freewill iFIS (SMART Trade) 20.01.01.04. Description: OS Command Injection via shell metacharacters to a report page. Root cause: improper handling of shell metacharacters in the report page input leads to command execution. Impact per CVSS: Confidentiality, Integrity, and ...

addPauser should be a two-step process in PauseAdmin.sol

Lines of code Vulnerability details Impact Adding new pauser should me two-step proccess. The identified issue pertains to the absence of a two-step process for adding a new pauser in the smart contract. This vulnerability could potentially allow an unauthorized entity to gain control over pausin...

Number withdrawn

CodeMeter is a security tool from Wibu-Systems that provides integrated technology for software developers and smart device companies. This CVE number has been withdrawn...

September 12, 2023—KB5030213 (OS Build 14393.6252) - EXPIRED

None None...

CVE-2023-36161

An issue was discovered in Qubo Smart Plug 10A version HSP02010114SYSTEM-10A, allows attackers to cause a denial of service DoS via Wi-Fi deauthentication...

CVE-2023-36161

An issue was discovered in Qubo Smart Plug 10A version HSP02010114SYSTEM-10A, allows attackers to cause a denial of service DoS via Wi-Fi deauthentication...

Design/Logic Flaw

An issue was discovered in Qubo Smart Plug 10A version HSP02010114SYSTEM-10A, allows attackers to cause a denial of service DoS via Wi-Fi deauthentication...

A week in security (September 4 - September 10)

Last week on Malwarebytes Labs: Supply chain related security risks, and how to protect against them Password-stealing Chrome extension smuggled on to Web Store Smart chastity device exposes sensitive user data X wants your biometric data Mac users targeted in new malvertising campaign delivering...

CVE-2023-36161

An issue was discovered in Qubo Smart Plug 10A version HSP02010114SYSTEM-10A, allows attackers to cause a denial of service DoS via Wi-Fi deauthentication...

Qubo Smart Plug Security Vulnerability

Qubo Smart Plug is a smart plug from Qubo. It effectively manages and tracks the energy consumption of devices through real-time power monitoring. A security vulnerability exists in the Qubo Smart Plug version 10A HSP02010114SYSTEM-10A, which stems from a vulnerability that allows an attacker to...

Incorrect Handling of Empty rights Parameter in delegateAll Function

Lines of code Vulnerability details Description The delegateAll function does not correctly handle the case where the rights parameter is empty. In this case, the function will attempt to write an empty string to the Storage.POSITIONSRIGHTS storage location. This behavior could lead to unexpected...

Use of tx.origin breaks interoperability with AA wallets.

Lines of code Vulnerability details In OptionPositionMananger, several functions like close and sellOptions, need to call PMWithdraw, which calls PMTransfer. Then it is checked that tx.origin != user. However, smart contract wallet cannot be tx.origin, which means AA wallets will not be able to...

The vulnerability of the JSON data processing library Json-smart, related to uncontrolled recursion, allows attackers to trigger a service failure.

The vulnerability of the JSON data processing library Json-smart is related to uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures...

Unchecked return value of low level call()/delegatecall()

Lines of code Vulnerability details The vulnerability related to an "Unchecked return value of low-level call/delegatecall" is a common and critical issue in Ethereum smart contracts. Let's break down this vulnerability and discuss its implications: 1. Low-Level Calls in Solidity: In Solidity,...