Privilege escalation

In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Deserialization of untrusted data

In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-0692

In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Unsafe cast in ConcentratedLiquidityPool burn leads to attack

Handle cmichel Vulnerability details The ConcentratedLiquidityPool.burn function performs an unsafe cast of a uint128 type to a signed integer. uint256 amount0fees, uint256 amount1fees = updatePositionmsg.sender, lower, upper, -int128amount; Note that amount is chosen by the caller and when...

CLSA-2021-1633442879 Fix of CVE: CVE-2020-26116, CVE-2020-8492, CVE-2018-20852, CVE-2020-27619

Add Oracle Linux distribution in platform.py - CVE-2018-20852: Prefix dot in domain for proper subdomain validation - CVE-2020-8492: Python allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client - CVE-2020-26116: http.client allows CRLF injection if...

Rails Unsafe Reflection

Ruby On Rails is a popular framework used to build web applications based on the Model-View-Controller MVC architectural pattern. Ruby On Rails provides a method called constantize which allows developers to dynamically find a constant by using a string. The most common usage of this method is to...

The vulnerability of the main() function of the dmgdmg2img conversion tool, which involves reading data beyond the allowable buffer size, allows an attacker to access confidential data and cause a service failure.

The vulnerability of the main function of the dmgdmg2img conversion tool lies in the lack of checks for the size of the read buffer during the memcpy operation within the function. Exploiting this vulnerability can allow an attacker to gain access to confidential data, as well as cause service...

GHSA-9378-F4V7-JGM4 Deserialization of Untrusted Data in org.apache.ddlutils:ddlutils

Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was insecure and used...

Prototype Pollution

Overview @brikcss/merge is an Utility to perform a deep merge of a list of objects or arrays. Affected versions of this package are vulnerable to Prototype Pollution via the Merge function. PoC // PoC.js var merge = require"@brikcss/merge" var obj = var maliciouspayload = '"proto":"polluted":"Yes...

Unsafe cast in IndexPool mint leads to attack

Handle cmichel Vulnerability details The IndexPool.mint function performs an unsafe cast of ratio to the uint120 type: uint120 ratio = uint120divtoMint, totalSupply; Note that toMint is chosen by the caller and when choosing toMint = 2120 totalSupply / BASE, the ratio variable will be 2120 and th...

Unsafe casts to uint120

Handle pauliax Vulnerability details Impact contract IndexPool does unsafe casts to uint120, e.g.: uint120 ratio = uint120divtoMint, totalSupply; It trusts the input from the user and converts without assurance that the value will fit in this narrow type. Depending on the pool state and parameter...

CVE-2021-41588

In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and signing keys...

CVE-2021-41588

In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and signing keys...

PT-2021-23351 · Gradle · Gradle Enterprise

Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions prior to 2021.1.3 Description: The issue allows a crafted request to trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and signing keys. Recommendations: For versions...

Fix of CVE: CVE-2018-20852, CVE-2020-8492, CVE-2020-26116, CVE-2020-27619

Add Oracle Linux distribution in platform.py - CVE-2018-20852: Prefix dot in domain for proper subdomain validation - CVE-2020-8492: Python allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client - CVE-2020-26116: http.client allows CRLF injection if...

CVE-2021-34723

A vulnerability in a specific CLI command that is run on Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the configuration database of an affected device. This vulnerability is due to insufficient validation of specific CLI command...

VulnCheck KEV: CVE-2020-9496

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03...

Code Injection

Overview In pac-resolver before 5.0.0 code-injection can occur when used with untrusted input, due to unsafe PAC file handling. Recommendation Upgrade to version 5.0.0 or later References - CVE - GitHub Advisory - Article...

The vulnerability of the savevm function in the QEMU hardware emulation software involves unsafe management of privileges, allowing a malicious actor to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the savevm function in the QEMU hardware emulation software relates to the ability to modify data stored in savevm. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and even cause service failures...

The vulnerability of the `dnn_execute_layer_pad` function in the `libavfilter/dnn/dnn_backend_native_layer_pad.c` file of the FFmpeg multimedia library, related to buffer overflow in memory, allows an attacker to access confidential data, compromise its integrity, and cause a service failure.

The vulnerability of the dnnexecutelayerpad function in the libavfilter/dnn/dnnbackendnativelayerpad.c file of the FFmpeg multimedia library is related to buffer overflows in memory due to insufficient size checking during the memcpy operation. Exploiting this vulnerability can allow an attacker ...