GSD-2022-1001122 KVM: x86/mmu: do compare-and-exchange of gPTE via the user address

KVM: x86/mmu: do compare-and-exchange of gPTE via the user address This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

PT-2022-29721

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description The issue is related to the KVM x86/mmu component, specifically concerning the comparison and exchange of gPTE via the user address. The actual impact and potential for attack have not been...

PT-2022-29395

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.2 through v5.17.1 Description The issue is related to the KVM x86/mmu component, specifically involving a compare-and-exchange of gPTE via the user address. The actual impact and attack plausibility have not yet been...

Evmos 授权问题漏洞

Evmos is a scalable, high-throughput proof-of-equity blockchain. It is used for full compatibility and interoperability with Ether. Evmos suffers from a security vulnerability that stems from an attacker's ability to siphon unclaimed funds from a user's address by exploiting the vulnerability...

[WP-H14] ConvexStakingWrapper, StakingRewards Wrong implementation will send concur rewards to the wrong receiver

Lines of code Vulnerability details UserInfo storage user = userInfopidmsgSender; updatePoolpid; ifuser.amount 0 uint pending = user.amount pool.accConcurPerShare / concurShareMultiplier - user.rewardDebt; if pending 0 safeConcurTransferrecipient, pending; ConvexStakingWrapper, StakingRewards is...

PT-2021-22471 · Nextcloud · Nextcloud Mail

Name of the Vulnerable Software and Affected Versions: Nextcloud Mail versions prior to 1.10.4 and 1.11.0 Description: The Nextcloud Mail application has a privacy filter issue that fails to filter images with a relative protocol, potentially leaking the read state or user IP. This issue is due t...

The assumption that operator == to (user) may not hold leading to failed timelock deposits

Handle 0xRajeev Vulnerability details Impact The contract uses msgSender to denote an operator who is operating on behalf of the user. This is typically used for meta-transactions where the operator is an intermediary/relayer who may facilitate gasless transactions on behalf of the user. They may...

Deposit whitelist enforced on msg.sender instead of user

Handle 0xRajeev Vulnerability details Impact The Treasury deposit function credits amount to the user address in parameter instead of the msgSender that is actually making the deposit whose rationale as explained in the Natspec comment is that this may be called via contract or L1-L2 bot. However...

CVE-2020-4912

IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-Force ID: 191287...

D-link DSL-2888A 访问控制错误漏洞

The D-link DSL-2888A is a Unified Services Router from D-link China. An authorization issue vulnerability exists in the D-Link DSL-2888A devices with firmware, which can be exploited by an attacker to assign a static IP address that has been previously used by a valid user...

Logic flaw vulnerability in JLCMS of Beijing Liangjing Zhicheng Technology Co.

LJCMS is a PHP+MYSQL based enterprise website system. There is a logic flaw vulnerability in JLCMS of Beijing Liang Jing Zhi Cheng Technology Co., Ltd. that can be exploited by attackers to obtain other people's user address information...

Logic Flaw Vulnerability in Liangjing Mall Online Shop Shopping System (CNVD-2020-27282)

Liangjing Mall online shopping system is a set of multi-functional online store system that can fit different types of goods and is super flexible. A logic flaw exists in LiangJing Mall Online Shop System, which can be exploited by an attacker to delete the address information of an entire site...

Information Disclosure in WildFire Appliance (WF-500)

Palo Alto Networks has determined that the WildFire Appliance WF-500 is affected by the vulnerability disclosure known as LazyFP and has completed an update to address these issues. The WildFire Appliance WF-500 software update is now available to customers that use the WildFire Appliance WF-500...

Starbucks: Bug in GraphQL and API integration leads to limited user address disclosure

A modified GraphQL query to fetch a user's address book entries led to a limited disclosure of user address book entries. The modified query resulted in a backend API request with undefined as a parameter. The response contained address lists of accounts with a username of undefined. We were not...

Kaspersky: Kaspersky Password Manager allows websites to access user's address data

Note: According to https://www.securityweek.com/kaspersky-adds-password-manager-bug-bounty-program and some other sources, Kaspersky Password Manager is in scope for this program. The program description doesn't reflect this however. Summary It is possible for websites to read out addresses that...

Magento Community Edition and Enterprise Edition Cross-Site Request Forgery Vulnerability

Magento is an open source PHP e-commerce system from Magento Inc. that provides rights management, search engine, and payment gateway.Magento Community Edition CE is a community edition.Magento Enterprise Edition EE is an enterprise edition. A cross-site request forgery vulnerability exists in...

CVE-2017-9724

In all Qualcomm products with Android releases from CAF using the Linux kernel, user-level permissions can be used to gain access to kernel memory, specifically the ION cache maintenance code is writing to a user supplied address...

Google Android Qualcomm Linux kernel privilege acquisition vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA, and the Qualcomm Linux kernel is one of the Qualcomm Linux kernels. A security vulnerability exists in the Qualcomm Linux kernel in Android. An attacker can exploit the...

Huacheng Gas Group Android APP has design flaws

Huacheng Gas Group Android APP is a client application that provides users with integrated management of remote meter reading and online bill payment. There is a design vulnerability in the verification code of Huacheng Gas Group Android APP. An attacker can use the vulnerability to reset any...

OIC Exponent CMS Information Disclosure Vulnerability (CNVD-2016-11167)

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. An information disclosure...