CVE-2022-3316

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass security feature via a crafted HTML page. Chromium security severity: Low...

GLSA-202210-16 : Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202210-16 Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities - Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to...

Malicious code in safe-nonce-7218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e864553aef6b02164be2545e5e92bc8443d5eea8820f88a44a30f84a773c8e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in safe-nonce-6218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b26fc284064f9aad0b6e5f8e05c9ee3c7d9642783b8431ac1e90a4bcdfc869a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5905 Malicious code in safe-nonce-6218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b26fc284064f9aad0b6e5f8e05c9ee3c7d9642783b8431ac1e90a4bcdfc869a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5906 Malicious code in safe-nonce-7218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e864553aef6b02164be2545e5e92bc8443d5eea8820f88a44a30f84a773c8e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Unsafe downcast operations can lead to silent failures

Lines of code Vulnerability details Solidity won't perform automatic checks when downcasting and it's possible for some fields to overflow while adding tiers. Proof of Concept Assume that in JBTiered721DelegateStore.recordAddTiers, one item for tiersToAdd contains votingUnits bigger than the size...

Transfering funds to yourself increases your balance

Lines of code Vulnerability details Impact Using temporary variables to update balances is a dangerous construction that has led to several hacks in the past. Here, we can see that toBalance can overwrite fromBalance: File: LBToken.sol 176: function transfer 177: address from, 178: address to, 17...

Upgraded Q -> M from 696 [1666361742731]

Judge has assessed an item in Issue 696 as Medium risk. The relevant finding follows: L05 - Usage of trasfer over call to send Ether could cause unexpected Reverts payablepayAddress.transferpayAmt; // royalty transfer to royaltyaddress The function payEther sends ether via transfer which passes a...

MAL-2022-5721 Malicious code in redirect-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2723505363a2e79b392ee0106e75b8f0a465536eb6b622c6f689123ea2d4a3bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2723505363a2e79b392ee0106e75b8f0a465536eb6b622c6f689123ea2d4a3bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CSRF protection for any URL can be bypassed in pipeline-input-step

pipeline-input-step 451.vf1aa4f405289 and earlier does not restrict or sanitize the optionally specified ID of the input step. This ID is used for the URLs that process user interactions for the given input step proceed or abort and is not correctly encoded. This allows attackers able to configur...

Safe Browsing Service DoS

The vulnerability of Google Chrome and Microsoft Edge browsers’ Safe Browsing service is related to insufficient validation of entered data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2022:10151-1 Rating: important References: 1204223 Cross-References: CVE-2022-3445 CVE-2022-3446 CVE-2022-3447 CVE-2022-3448 CVE-2022-3449 CVE-2022-3450 Affected Products: openSUSE Backports SLE-15-SP3 An update...

Chromium: CVE-2022-3449 Use after free in Safe Browsing

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Microsoft Edge (Chromium) < 106.0.1370.47 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 106.0.1370.47. It is, therefore, affected by multiple vulnerabilities as referenced in the October 14, 2022 advisory. - Use after free in Skia. CVE-2022-3445 - Heap buffer overflow in WebSQL. CVE-2022-3446 -...

KLA20008 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Heap buffer overflow vulnerability in WebSQL can be exploit...

Google Chrome Safe Browsing Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 106.0.5249.119. The vulnerability stems from a Safe Browsing use-after-release and can be exploited by an attacker to trick a user into installing a...

CVE-2022-35944

October is a self-hosted Content Management System CMS platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin pan...

Design/Logic Flaw

October is a self-hosted Content Management System CMS platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin pan...