1936 matches found
NFT transfer approvals are not removed and cannot be revoked thus leading to loss of NFT tokens
Handle 0xRajeev Vulnerability details Impact NFT transfer approvals that are set to true in approveTransferERC721 are never set to false and there is no way to remove such an nft approval. Impact-1: The approval is not removed set to false after a transfer in transferERC721. So if the NFT is ever...
Delegated transfer of owner fails
Handle cmichel Vulnerability details Vulnerability Details The Visor.delegatedTransferERC20 function skips the approval check if msg.sender == getOwner, however, it will still try to reduce the approval in that case. As it is implemented that the owner does not need an approval for this function,...
nftApprovals not reset in transferERC721
Handle gpersoon Vulnerability details Impact The function transferERC721 checks for nftApprovals, however it never reset the value of nftApprovals. This means if the NFT would end up in the contract again in the future, it could be transferred again without an explicit approval. Proof of Concept...
Mozilla 信任管理问题漏洞
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla is vulnerable to a trust management issue vulnerability that stems from a flaw in the embedded certificate code that could allow a website to install a root certificate on a device without user...
Cross-Site Request Forgery in ForkCMS
Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to 1 approve the mass of the user's comments, 2 restoring a deleted user, 3 installing or running modules, 4 resetting the...
Critical RCE Bug Found in Homebrew Package Manager for macOS and Linux
A recently identified security vulnerability in the official Homebrew Cask repository could have been exploited by an attacker to execute arbitrary code on users' machines that have Homebrew installed. The issue, which was reported to the maintainers on April 18 by a Japanese security researcher...
Lark Technologies: Non privileged user is able to approve his own app himself leading to mass privilege escalations.
A privilege escalation vulnerability was identified in Lark which could have potentially allowed an attacker to approve the apps in the same tenant by bypassing the admin approval. We thank @imrannisar for reporting this to our team...
SQL Injection Vulnerability in Human Evidence Rubik's Cube Management System
Human ID Magic is a citizen's personal information approval software, using advanced face recognition count and fingerprint comparison technology, can be directly in the field to quickly compare the real person with the side of the document information, real-time uploading database, to provide...
Description of the security update for SharePoint Enterprise Server 2016: April 13, 2021 (KB4504719)
None None...
CVE-2021-24147
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting...
西门子 Mendix 安全漏洞
Mendix Forgot Password Appstore module allows users to register applications or reset their own passwords without administrator involvement. An improper access control vulnerability exists in the Siemens Mendix Forgot Password Appstore module. An attacker could exploit the vulnerability to take...
ALERT: Malicious Amazon Alexa Skills Can Easily Bypass Vetting Process
Researchers have uncovered gaps in Amazon's skill vetting process for the Alexa voice assistant ecosystem that could allow a malicious actor to publish a deceptive skill under any arbitrary developer name and even make backend code changes after approval to trick users into giving up sensitive...
Using the Manager Attribute in Active Directory (AD) for Password Resets
Creating workflows around verifying password resets can be challenging for organizations, especially since many have shifted work due to the COVID-19 global pandemic. With the numbers of cyberattacks against businesses exploding and compromised credentials often being the culprit, companies have ...
Using the Manager Attribute in Active Directory (AD) for Password Resets
Creating workflows around verifying password resets can be challenging for organizations, especially since many have shifted work due to the COVID-19 global pandemic. With the numbers of cyberattacks against businesses exploding and compromised credentials often being the culprit, companies have ...
Hackers Leak Stolen Pfizer-BioNTech COVID-19 Vaccine Data
On the heels of a previously-reported cyberattack on the European Medicines Agency EMA, cybercriminals have spilled compromised data related to COVID-19 vaccinations onto the internet. The EMA is an agency of the European Union in charge of the evaluation and supervision of medicinal products in...
CVE-2020-23960
Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to 1 approve the mass of the user's comments, 2 restoring a deleted user, 3 installing or running modules, 4 resetting the...
WordPress Popup Builder plugin <= 3.69.6 - Multiple Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Stored Cross-Site Scripting XSS vulnerabilities were found by Ilca Lucian Florin in the WordPress Popup Builder plugin versions = 3.69.6. Solution 2020-12-14 - awaiting patch approval...
Hackers Are Targeting the Covid-19 Vaccine ‘Cold Chain’
As vaccines await US approval, a sophisticated global phishing campaign has tried to harvest credentials from companies involved in their distribution...
BigBlueButton 2.2.29 E-mail Validation Bypass
Title: BigBlueButton E-mail Validation Bypass Google Dork: N/A Date: 24.11.2020 Author: Seccops https://seccops.com Vendor Homepage: bigbluebutton.org Version: 2.2.29 and previous versions CVE: CVE-2020-29043 === Summary === An issue was discovered in BigBlueButton through 2.2.29. When at attacke...
