PT-2023-22417 · Third Reality · Third Reality Smart Blind

Name of the Vulnerable Software and Affected Versions: Third Reality Smart Blind version 1.00.54 Description: The issue allows a remote attacker to send malicious Zigbee messages to a vulnerable device, causing it to crash. This is a denial-of-service vulnerability. Recommendations: For Third...

Third Reality Smart Blind 输入验证错误漏洞

Third Reality Smart Blind is a smart blind from Third Reality. A security vulnerability exists in Third Reality Smart Blind version 1.00.54. An attacker exploited the vulnerability to send a malicious Zigbee message to a vulnerable device and cause a crash...

CVE-2023-1370

A flaw was found in the json-smart package. This security flaw occurs when reaching a ‘‘ or ‘‘ character in the JSON input, and the code parses an array or an object, respectively. The 3PP does not have any limit to the nesting of such arrays or objects. Since nested arrays and objects are parsed...

CISA and Partners Release Cybersecurity Best Practices for Smart Cities

Today, CISA, NSA, FBI, NCSC-UKlink is external, ACSClink is external, CCCSlink is external and NCSC-NZlink is external released a joint guide: Cybersecurity Best Practices for Smart Cities. Smart cities may create safer, more efficient, resilient communities through technological innovation and...

An attacker can mint himself many tokens for free by cloning a position and adjusting its price

Lines of code Vulnerability details Impact A malicious attacker can mint himself the max limit amount of tokens of any position for free, by cloning a position and manipulating its price. Proof of Concept Steps overview: 1. a The attacker clones an existing position 2. b The attacker sets the pri...

Underflow in suggestMinter function

Lines of code Vulnerability details Impact The suggestMinter function in the smart contract allows users to suggest a new minter address by specifying an application period, an application fee, and a message. The function sets the mintersminter mapping to the current block timestamp plus the...

createNewPosition/clonePosition/createClone are suspicious of the reorg attack

Lines of code Vulnerability details Description The createNewPosition function creates a new position smart contract and returns its address. The address is determined by create address derivation, that depends on the contract nonce. Later user could use interact with newly created contract. At t...

WordPress Smart WooCommerce Search Plugin <= 2.5.0 is vulnerable to Broken Access Control

Software Smart WooCommerce Search Type Plugin Vulnerable versions = 2.5.0 Fixed in 2.5.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-30783 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 62fafaa98313 Credits István Márton Requir...

CVE-2023-30541

OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding,...

Code injection

OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding,...

CVE-2023-30541 TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts

OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding,...

CVE-2023-30541

OpenZeppelin Contracts vulnerability CVE-2023-30541: The TransparentUpgradeableProxy can fail to delegate a function if its selector clashes with the proxy’s own selectors, causing a revert during calldata decoding when signatures are incompatible. The issue has been fixed in version 4.8.3. Impac...

CVE-2023-30541 TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts

OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding,...

Are Smart Home Devices Invading Your Privacy?

By Owais Sultan Smart home devices are becoming more and more popular in recent years, promising convenience and automation to enhance… This is a post from HackRead.com Read the original post: Are Smart Home Devices Invading Your Privacy?...

Security Bulletin: IBM Workload Scheduler potentially affected by a vulnerability found in Json-smart library (CVE-2023-1370)

Summary IBM Workload Scheduler is potentially affected by a vulnerability found in Json-smart library that can cause a stack exhaustion stack overflow and software crash. Specifically, the following plugins can suffer from this issue: Azure Storage Job Executor, Azure Resource Manager Job Executo...

PT-2023-16599 · Lenovo · Lenovo Smart Clock Essential

Name of the Vulnerable Software and Affected Versions: Lenovo Smart Clock Essential with Alexa Built In affected versions not specified Description: A default password in the device could allow unauthorized access to an attacker with local network access. Recommendations: At the moment, there is ...

CVE-2023-24503 Electra Smart Kit for Split AC – Adjacent attacker may cause the unit to load unauthorized FW

Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW...

CVE-2023-24503 Electra Smart Kit for Split AC – Adjacent attacker may cause the unit to load unauthorized FW

Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW...

CVE-2023-30542

OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint propose in GovernorCompatibilityBravo allows the creation of proposals with a signatures array shorter than the calldatas array. This causes the additional elements of the latter to be...

Design/Logic Flaw

OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint propose in GovernorCompatibilityBravo allows the creation of proposals with a signatures array shorter than the calldatas array. This causes the additional elements of the latter to be...