13897 matches found
Wrapped idiosyncratic (non-tradable) fCash can possibly not be unwrapped prior to maturity
Lines of code Vulnerability details What is idiosyncratic fCash? Markets may not always trade at the exact maturities of all fCash assets. fCash that does not fall on an exact maturity is called idiosyncratic fCash. To value these assets, Notional takes the linear interpolation of the rates of th...
Samsung SmartThings Access Control Error Vulnerability
Samsung SmartThings is a powerful Samsung smart home mobile app from Samsung South Korea.An access control error vulnerability exists in versions prior to Samsung SmartThings 1.7.85.25. The vulnerability stems from improper access control and can be exploited by local attackers to bypass login...
CVE-2022-31040
CVE-2022-31040 affects Open Forms before versions 1.0.9 and 1.1.1, where the cookie consent page contains an open redirect via an injectable referer query parameter. The issue enables phishing redirects initiated by the Open Forms backend on a legitimate page. Connected sources confirm patches in...
Upgraded Q -> H from 25 [1655007954017]
Judge has assessed an item in Issue 25 as High risk. The relevant finding follows: Fees should have a boundary of 100% 10000: Otherwise the contract will try to transfer more than possible which will result in reverts: It might also be helpful the have an fixed upper boundary that doesn't allow t...
New Privacy Framework for IoT Devices Gives Users Control Over Data Sharing
A newly designed privacy-sensitive architecture aims to enable developers to create smart home apps in a manner that addresses data sharing concerns and puts users in control over their personal information. Dubbed Peekaboo by researchers from Carnegie Mellon University, the system "leverages an...
CVE-2022-29255
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address including side effects could be evaluated twice. This may result in incorrect outcomes for contracts. This issue...
Design/Logic Flaw
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address including side effects could be evaluated twice. This may result in incorrect outcomes for contracts. This issue...
USN-5281-1: OpenSC vulnerabilities
It was discovered that some OpenSC smart card drivers mishandled memory when performing certain decoding operations. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. CVE-2019-15945,...
CVE-2022-30749
Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity...
CVE-2022-30747
PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent...
CVE-2022-30746
Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API...
CVE-2022-30747
PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent...
CVE-2022-30749
Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity...
CVE-2022-30749
Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity...
Spoofing
PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent...
Improper access control
Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity...
Design/Logic Flaw
Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API...
CVE-2022-30749
Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity...
CVE-2022-30749
CVE-2022-30749 affects Samsung SmartThings prior to version 1.7.85.25. The issue is improper access control that allows local attackers to bypass login and add arbitrary devices. Root cause: inadequate access control checks in the login/authorization flow. Impact: local attacker can extend device...