CVE-2022-40135

An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory...

Information disclosure

An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory...

CVE-2022-40135

CVE-2022-40135 concerns an information-leak in the Smart USB Protection SMI Handler affecting Lenovo devices. The vulnerability may allow a local attacker with elevated privileges to read SMM memory. The PT-2022-25236 entry confirms the issue but provides no specific affected models/versions or a...

Any user is able to mint a new receipt/ticket tokens

Lines of code Vulnerability details Impact In the RabbitHoleReceipt and RabbitHoleTickets contracts the minterAddress should be the only account allowed to mint a new token, but due to an error in the onlyMinter modifier all the users are able to mint new tokens without permission, the impact of...

Wrongly implemented modifier allow anybody to mint receipts.

Lines of code Vulnerability details Impact Quest rewards can be claimed by anybody without completing any task. RabbitHoleReceipt.onlyMinter modifier purpose is to allow only designated addresses to mint new receipts like QuestFactory smart contract. But since the input is not validated anybody c...

Wrongly implemented modifier allow everybody to mint Rabbit Hole tickets.

Lines of code Vulnerability details Impact As specified on RabbitHole C4 contest page, RabbitHoleTickets smart contract 'is an 1155 reward contract used by the RabbitHole team.' Meaning that the assets managed by this smart contract have value. Moreover this contract implements ERC-2981: NFT...

Replayable signature in the mintReceipt function

Lines of code Vulnerability details Description In the mintReceipt function there is a check of the claimSignerAddress signature: if keccak256abi.encodePackedmsg.sender, questId != hash revert InvalidHash; if recoverSignerhash, signature != claimSignerAddress revert AddressNotSigned; The signatur...

Unpacking the "0x1626ba7e" Mystery: The Risks of Unidentified Fixed Values in Smart Contracts - loss of funds

Lines of code Vulnerability details Impact The use of a fixed value in the require statement without understanding its significance creates a security vulnerability in the contract. An attacker could manipulate the returned value to bypass the require statement and execute malicious code. This ca...

Loss of ETH for proposer when it is a contract that doesn't have fallback function.

Lines of code Vulnerability details The issue that is described in code-423n4/2022-12-tessera-findings40 was not mitigated and still applies like it is described there. --- The text was updated successfully, but these errors were encountered: All reactions...

Ubuntu: Security Advisory (USN-5281-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

User can open position without depositing tokens

Lines of code Vulnerability details Impact User can mint long/short tokens without depositing anything. This is because the function on LN 172 doesn't check the contents of the returned data from the function, and the function doesn't verify that the contract has indeed received the expected...

CVE-2022-47100

A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE 802.15.4 frame...

CVE-2022-47100

A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE 802.15.4 frame...

Design/Logic Flaw

A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE 802.15.4 frame...

Sengled Smart bulb 安全漏洞

Sengled Smart bulb is a sensor multi-color smart bulb from Sengled. A security vulnerability exists in Sengled Smart bulb version 0x0000024, which stems from a vulnerability that allows an attacker to perform a factory reset on an arbitrary device via a crafted IEEE 802.15.4 frame...

Unsecured usage of msg.sender in smart contract functions TimeswapV2Pool.sol.

Lines of code Vulnerability details Impact The bug is related to the use of the msg.sender in the smart contract functions. The msg.sender is a built-in variable in the Solidity programming language, which represents the address of the account that called the function, the msg.sender is used to...

CVE-2022-47052

CVE-2022-47052 affects NETGEAR Nighthawk R6220 AC1200 Smart Wi‑Fi Router. The web interface is vulnerable to a CRLF Injection that enables Reflected XSS and HTML Injection when a malicious, unauthenticated user requests a specially crafted URL. Impact is described as low confidentiality and integ...

CVE-2022-47100

The CVE-2022-47100 entry concerns Sengled Smart bulb version 0x0000024, where a vulnerability allows an attacker to arbitrarily perform a factory reset via a crafted IEEE 802.15.4 frame. The available data identifies impact as availability loss (device reset), with CVSS v3.1 metrics showing Netwo...

PT-2023-15170 · Sengled · Sengled Smart Bulb

Name of the Vulnerable Software and Affected Versions: Sengled Smart bulb version 0x0000024 Description: A vulnerability in the Sengled Smart bulb allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE 802.15.4 frame. Recommendations: For Sengled Smart bulb versi...

CVE-2022-47100

A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE 802.15.4 frame...