GSD-2022-1002951 f2fs: fix to do sanity check on total_data_blocks

f2fs: fix to do sanity check on totaldatablocks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...

Yieldy._storeRebase() saves and emits wrong values.

Lines of code Vulnerability details Impact Yieldy.storeRebase saves and emits wrong values. I don't think the asset will be lost directly because of this but the rebase storage will have wrong values and it might affect the system later. Proof of Concept The previousCirculating must be a previous...

CVE-2022-32127

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/viewbebrowsed/total...

WordPress W3 Total Cache Plugin < 2.1.4 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:boldgrid:w3totalcache"; if description...

WordPress W3 Total Cache Plugin < 2.1.3 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:boldgrid:w3totalcache"; if description...

WordPress W3 Total Cache Plugin < 2.1.5 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:boldgrid:w3totalcache"; if description...

CVE-2022-32127: Improper Neutralization of Input During Web Page Generation

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/viewbebrowsed/total...

CVE-2022-32130: Improper Neutralization of Input During Web Page Generation

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/downresume/total/nature...

Malicious code in klook-node-framework-experiment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0620cf6726fbf4eed556cd2acf308841477671f166e470d3f28d0a8c437fdcaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

fund lose because of the direct funds transfer to vault address and cause big balance() to totalSupply() ratio and cause big division error in _mintSharesFor() (this is in previous contest scope)

Lines of code Vulnerability details Impact Attacker can cause balance / totalSupply ratio to go as high as he want and then because of rounding error in mintSharesFor lower amount of share would be mint for users. if totalSupply is 0 attacker can directly transfer tokens to contract address and...

Firefox stops advertisers tracking you as you browse, calls itself the most “private and secure major browser”

Cookies are in the news as Mozilla rolls out significant privacy changes for Firefox. The idea is to dramatically lessen the risk of privacy-invading tracking across websites without your knowledge. Tracking cookies have been a hot topic in recent months, as advertisers try switching to other...

Aura.sol mint() function has a bug in the logic

Lines of code Vulnerability details Impact Intention is that during inflation period operator will or at least will be able to min EMISSIONSMAXSUPPLY token amount. Due to a logic bug amount of operator mintable tokens directly depends on how many tokens are minted by function minterMint and init...

CVE-2022-31467

A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leading to execution of arbitrary code, via the installer not restricting the search path for required DLLs and then not verifying the signature...

CVE-2022-31466

Time of Check - Time of Use TOCTOU vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, potentially leading to deletion of system files. This is achieved through exploiting the time between detecting a file as malicious and when th...

CVE-2022-31467

A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leading to execution of arbitrary code, via the installer not restricting the search path for required DLLs and then not verifying the signature...

CVE-2022-31467

A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leading to execution of arbitrary code, via the installer not restricting the search path for required DLLs and then not verifying the signature...

Design/Logic Flaw

Time of Check - Time of Use TOCTOU vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, potentially leading to deletion of system files. This is achieved through exploiting the time between detecting a file as malicious and when th...

CVE-2022-31466 TOCTOU Vulnerability in Quick Heal Total Security

Time of Check - Time of Use TOCTOU vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, potentially leading to deletion of system files. This is achieved through exploiting the time between detecting a file as malicious and when th...

CVE-2022-31466

CVE-2022-31466 is a TOCTOU vulnerability in Quick Heal Total Security, affected versions prior to 12.1.1.27. The issue arises from the window between malware detection and quarantine/cleanup, enabling a local attacker to replace the quarantined file with a symlink and escalate privileges, potenti...

CVE-2022-31467

A DLL hijacking vulnerability (CVE-2022-31467) affects Quick Heal Total Security prior to version 12.1.1.27. The installer does not restrict the DLL search path and fails to verify DLL signatures, enabling a local attacker to escalate privileges and execute arbitrary code. The Red Hat/NVD entries...