52 matches found
Malicious code in certik-swc-registry (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2f22793a81034cf1e21878cc6fe59a7213528c5cac0db741b20ec86800a7531 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
clipass (=0.1.0), clipperd (>=0.1.1 <=0.1.5) +15 more potentially affected by unknown CVE via magic-crypt (=3.1.13)
magic-crypt CARGO version =3.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on magic-crypt and may be impacted: - clipass =0.1.0 - clipperd =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.19.7, =0.35.0 and...
MAL-2024-7969 Malicious code in legacy-swc-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49e695d88baed2f53db3da619c1ea2230342d8f853e21cfba4ba15019326e6ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in legacy-swc-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49e695d88baed2f53db3da619c1ea2230342d8f853e21cfba4ba15019326e6ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
M-02 Unmitigated
Lines of code Vulnerability details Description The mitigation recommendation is not right. To understand the issue I strongly recommend the lecture of this article. In particular, sections "Insufficient Gas Griefing Attack" and "Workaround Against “Insuficient Gas Griefing attack”". The issue...
CVE-2023-27826
SeowonIntech SWC 5100W WIMAX Bootloader 1.18.19.0, HW 0.0.7.0, and FW 1.11.0.1, 1.9.9.4 are vulnerable to OS Command Injection. which allows attackers to take over the system with root privilege by abusing doSystem function...
CVE-2023-27826
CVE-2023-27826 affects SeowonIntech SWC 5100W WIMAX Bootloader: vulnerable components are bootloader version 1.18.19.0, HW 0.0.7.0, and FW 1.11.0.1 and 1.9.9.4. Root cause is an OS command injection via the doSystem() function, enabling an attacker to take over the system with root privileges. Pu...
WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE
Exploit Title: WIMAX SWC-5100W Firmware V1.11.0.1 :1.9.9.4 - Authenticated RCE Vulnerability Name: Ballin' Mada Date: 4/3/2023 Exploit Author: Momen Eldawakhly Cyber Guy Vendor Homepage: http://www.seowonintech.co.kr/eng/main Version: Bootloader1.18.19.0 , HW 0.0.7.0, FW1.11.0.1 : 1.9.9.4 Tested...
WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated Remote Code Execution Exploit
Exploit Title: WIMAX SWC-5100W Firmware V1.11.0.1 :1.9.9.4 - Authenticated RCE Vulnerability Name: Ballin' Mada Exploit Author: Momen Eldawakhly Cyber Guy Vendor Homepage: http://www.seowonintech.co.kr/eng/main Version: Bootloader1.18.19.0 , HW 0.0.7.0, FW1.11.0.1 : 1.9.9.4 Tested on: Unix CVE :...
WIMAX SWC-5100W Remote Command Execution
Exploit Title: WIMAX SWC-5100W Firmware V1.11.0.1 :1.9.9.4 - Authenticated RCE Vulnerability Name: Ballin' Mada Date: 4/3/2023 Exploit Author: Momen Eldawakhly Cyber Guy Vendor Homepage: http://www.seowonintech.co.kr/eng/main Version: Bootloader1.18.19.0 , HW 0.0.7.0, FW1.11.0.1 : 1.9.9.4 Tested...
SWC-109 Uninitialized Storage Pointer
Lines of code Vulnerability details Impact Uninitialized local storage variables can point to unexpected storage locations in the contract, which can lead to intentional or unintentional vulnerabilities. Proof of Concept Exploit Vulnerability OrderStatus storage orderStatus; Tools Used github...
Uninitialized Storage Variables
Lines of code github.com/jbx-protocol/juice-nft-rewards/blob/f9893b1497098241dd3a664956d8016ff0d0efd0/contracts/JBTiered721DelegateStore.solL344 github.com/jbx-protocol/juice-nft-rewards/blob/f9893b1497098241dd3a6649568016ff0d0efd0/contracts/JBTiered721DelegateStore.solL1024 Vulnerability details...
Unchecked Call Return Value
Lines of code Vulnerability details Impact The return value of a message call is not checked. Execution will resume even if the called contract throws an exception. If the call fails accidentally or an attacker forces the call to fail, this may cause unexpected behaviour in the subsequent program...
No check if 'ecrecover()' fails
Lines of code Vulnerability details Impact addMember function makes a call to 'ecrecover' to grab the 'community owner' & 'new member'. The problem is that if 'ecrecover' fails it will return a 0 which is currently not guarded against. This was a problem in the famous Polygon Matic token bug. The...
Upgraded Q -> M from 205 [1655579891083]
Judge has assessed an item in Issue 205 as Medium risk. The relevant finding follows: transfer and send methods are used inside the codebase. Since these methods use 2300 gas stipend which is not adjustable,it may likely to get broken when calling a contract's fallback function if any contract...
ClearingHouse looping over dynamic array might result in a DOS because of the block gas limit
Lines of code Vulnerability details Impact Inside the ClearingHouse contract there are multiple instances where it loops over the dynamic amms array. There is no way looping over a subset of the array or continuing for you left off. Thus, if the array is large enough certain functions won't be...
Looping over dynamic array might result in DoS through the block gas limit
Handle Ruhum Vulnerability details Impact Because of the block gas limit, looping over a dynamic array that grows over time might result in a DoS at some point. Both the PoolTemplate and the IndexTemplate have such dynamic arrays. Both don't have any functionality to decrease the size. Meaning, i...
_mint721() function can be broken because of strict equality check on token balance
Handle jayjonah8 Vulnerability details Impact In NFTXMarketplaceZap.sol the mint721 function has a require check that the balance must be equal to the amount of vault tokens in the contract. uint256 balance = count BASE - count INFTXVaultvault.mintFee; requirebalance ==...
NK Hackers Deploy Browser Exploits on South Korean Sites to Spread Malware
A North Korean threat actor has been discovered taking advantage of two exploits in Internet Explorer to infect victims with a custom implant as part of a strategic web compromise SWC targeting a South Korean online newspaper. Cybersecurity firm Volexity attributed the watering hole attacks to a...
