PT-2022-25972 · Unknown · Fingerprint Trusted Application

Name of the Vulnerable Software and Affected Versions: Fingerprint trusted application TA affected versions not specified Description: The issue is related to heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application. Successful exploitation of thi...

PT-2022-25967 · Unknown · Fingerprint Trusted Application

Name of the Vulnerable Software and Affected Versions: Fingerprint trusted application TA affected versions not specified Description: The issue concerns heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application. Successful exploitation may affect...

CVE-2022-41595

CVE-2022-41595 affects the fingerprint trusted application (TA) on Huawei/HarmonyOS devices. The issue is described as a heap overflow, out-of-bounds read, and null pointer vulnerability in the fingerprint TA that could impact the fingerprint service. Connected sources specify the vulnerability i...

CVE-2022-41597

The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application TA.Successful exploitation of this vulnerability may affect the fingerprint service...

CVE-2022-41600

The vulnerability described as CVE-2022-41600 affects the fingerprint trusted application (TA) on HarmonyOS devices. Connected documents corroborate a heap overflow, out-of-bounds read, and null pointer vulnerabilities within the fingerprint TA that could, if exploited, impact the fingerprint ser...

CVE-2022-41593

CVE-2022-41593 affects the Huawei/HarmonyOS fingerprint trusted application (TA) on phones, with root causes described as heap overflow, out-of-bounds read, and null pointer vulnerabilities that may affect the fingerprint service. Concrete exploit details, affected versions, and product scope are...

CVE-2022-40147

A vulnerability has been identified in Industrial Edge Management All versions V1.5.1. The affected software does not properly validate the server certificate when initiating a TLS connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between...

ExecutionDelegate can approve arbitrary calling contract

Lines of code Vulnerability details Impact Owner can steal users' funds and tokens. Proof of Concept The owner of ExecutionDelegate can approve any contract to call it, e.g. a malicious contract which can then drain all funds and tokens approved by users to ExecutionDelegate. Users should only...

CVE-2022-38709

IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2022-38709

IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

matrix-js-sdk subject to impersonated messages due to permissive key forwarding

Impact An attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too...

GHSA-6263-X97C-C4GG matrix-js-sdk subject to impersonated messages due to permissive key forwarding

Impact An attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too...

Vulnerabilities found in Xpdf

Vulnerabilities have been fixed in Xpdf. The vulnerabilities allow a malicious person to cause a denial-of-service. For the vulnerabilities, Proof-of-Concept code is publicly available. The developers of Xpdf give no indication that any actively observed misuse as well. At the time of writing thi...

Code Injection

Overview snyk is a advanced tool that scans and monitors projects for security vulnerabilities. Affected versions of this package are vulnerable to Code Injection. when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such a...

DEBIAN-CVE-2022-39250

Matrix JavaScript SDK is the Matrix Client-Server software development kit SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one o...

Design/Logic Flaw

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this m...

CVE-2022-39257

The CVE concerns Matrix iOS SDK prior to 0.23.19, where a too-permissive key forwarding policy allows an attacker coordinating with a malicious homeserver to create messages that appear to come from another user. The SDK now enforces stricter forwarding: forwarded keys are accepted only in respon...

CVE-2022-39257 Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessions

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this m...

CVE-2022-39257 Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessions

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this m...

DEBIAN-CVE-2022-39249

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be...