DEBIAN-CVE-2023-4785

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms ex. Linux allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Jav...

com.full.dialer.top.secure.crypted security vulnerability

com.full.dialer.top.secure.crypted is a library by actuator personal developer. A security vulnerability exists in com.full.dialer.top.secure.crypted 1.0.1 and earlier versions, which stems from allowing any installed application to make a phone call by sending a crafted intent...

CVE-2023-42468

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...

CVE-2023-42468

CVE-2023-42468 affects the Android app com.cutestudio.colordialer (versions up to 2.1.8-2). The vulnerability stems from an improperly exported DialerActivity, allowing a remote attacker to initiate phone calls without user consent by crafting an android.intent.action.CALL intent with a tel: URI ...

CVE-2023-42468

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...

The vulnerability of the Microsoft Exchange Server email server is related to access control errors, which allow a hacker to execute arbitrary code within the context of the server’s user account.

The vulnerability of Microsoft Exchange Server is related to access control errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the server’s account context through a remote network call...

PT-2023-28358 · Unknown · Com.Cutestudio.Colordialer

Name of the Vulnerable Software and Affected Versions: com.cutestudio.colordialer versions 2.1.8-2 and earlier Description: The issue allows a remote attacker to initiate phone calls without user consent due to improper export of the com.cutestudio.dialer.activities.DialerActivity component. A...

gRPC Security Vulnerabilities

gRPC is a modern, open-source, high-performance Remote Procedure Call RPC framework from gRPC Open Source. A security vulnerability exists in gRPC version 1.23 that stems from a lack of error handling in the TCP server, allowing an attacker to cause a denial of service by initiating a large numbe...

CVE-2023-41368

The OData service of the S4 HANA Manage checkbook apps - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call...

Failure to Return Value from Low-Level Call

Lines of code Vulnerability details In Solidity, the "low-level call" operation, often used with inline assembly, is a powerful tool for interacting with external contracts. However, there is a specific bug related to low-level calls that can result in unexpected behavior. Instances 1: File:...

A malicious contract could steal assets via a flash loan

Lines of code Vulnerability details Impact A malicious contract could fail to return the assets, essentially stealing the Proof of Concept The key vulnerability is in the flashloan function. It transfers the assets to the receiver contract specified in info.receiver without any checks. Then it...

No way to revoke Approval in DelegateToken.approve leads to un authorized calling of DelegateToken.transferFrom

Lines of code Vulnerability details Impact There is no way to revoke the approval which given via DelegateToken.approveaddress,delegateTokenId. They can able call the DelegateToken.transferFrom even the tokenHolder revoke the permission using the DelegateToken.setApprovalForAll if the spender...

Unchecked return value of low level call()/delegatecall()

Lines of code Vulnerability details The vulnerability related to an "Unchecked return value of low-level call/delegatecall" is a common and critical issue in Ethereum smart contracts. Let's break down this vulnerability and discuss its implications: 1. Low-Level Calls in Solidity: In Solidity,...

The vulnerability of Google’s gRPC remote procedure call system allows a attacker to trigger a service failure.

The vulnerability of the Google gRPC process callouts is related to the lack of use of the assert function. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

Citrix Audio Diagnostic Tool

Citrix Audio Diagnostics tool 1.0.3 What’s new for this release? Support new policy Loss Tolerant Mode for Audio. Optimize the display of network metrics for high round-trip times ICA RTT. Support command-line mode and a runtime option in seconds, allowing the tool to operate in the background fo...

Snapchat: Intent Leads To Unauthorised Video Call Initiation Leaking Surrounding Informations Of Victim

The Snapchat Android application was found to contain a vulnerability that allowed a malicious user to initiate an unauthorized video call with a victim. The vulnerability was triggered by a deep link that, when clicked by the victim, forced the victim's Snapchat application to initiate a video...

Oracle Linux 5 : ELSA-2012-1174-1: / kernel (ELSA-2012-11741)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-11741 advisory. - The rioioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows...

Stealing extra mint fund by applying reentrancy attack on _execute with calling approve() again due to external call before crucial state update

Lines of code Vulnerability details Impact By applying reentrancy attack involving the function mintIfThresholdMet, an user can steal extra amount of mint fund. Proof of Concept The functions mintIfThresholdMet make external mint call prior to updating the txnHashToTransaction state. If the real...

D-Link DAP-1325 HNAP SetAPLanSettings Mode Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoin...

D-Link DAP-1325 HNAP SetAPLanSettings Gateway Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoin...