Saphira Connect SQL Injection Vulnerability

Saphira Connect is a telephone exchange and call center server mobile application from Saphira Connect, Inc. An SQL injection vulnerability exists in versions prior to Saphira Connect 9 that stems from incorrect neutralization of specific elements used by the system...

CVE-2023-42468

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...

CVE-2023-42468

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...

CVE-2023-42468

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...

Design/Logic Flaw

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...

CVE-2023-42469

The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.full.dialer.top.secure.encrypted.activities.DialerActivity component...

DEBIAN-CVE-2023-4785

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms ex. Linux allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Jav...

com.full.dialer.top.secure.crypted security vulnerability

com.full.dialer.top.secure.crypted is a library by actuator personal developer. A security vulnerability exists in com.full.dialer.top.secure.crypted 1.0.1 and earlier versions, which stems from allowing any installed application to make a phone call by sending a crafted intent...

CVE-2023-42468

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...

CVE-2023-42468

CVE-2023-42468 affects the Android app com.cutestudio.colordialer (versions up to 2.1.8-2). The vulnerability stems from an improperly exported DialerActivity, allowing a remote attacker to initiate phone calls without user consent by crafting an android.intent.action.CALL intent with a tel: URI ...

CVE-2023-42468

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...

PT-2023-28358 · Unknown · Com.Cutestudio.Colordialer

Name of the Vulnerable Software and Affected Versions: com.cutestudio.colordialer versions 2.1.8-2 and earlier Description: The issue allows a remote attacker to initiate phone calls without user consent due to improper export of the com.cutestudio.dialer.activities.DialerActivity component. A...

The vulnerability of the Microsoft Exchange Server email server is related to access control errors, which allow a hacker to execute arbitrary code within the context of the server’s user account.

The vulnerability of Microsoft Exchange Server is related to access control errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the server’s account context through a remote network call...

gRPC Security Vulnerabilities

gRPC is a modern, open-source, high-performance Remote Procedure Call RPC framework from gRPC Open Source. A security vulnerability exists in gRPC version 1.23 that stems from a lack of error handling in the TCP server, allowing an attacker to cause a denial of service by initiating a large numbe...

CVE-2023-41368

The OData service of the S4 HANA Manage checkbook apps - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call...

Failure to Return Value from Low-Level Call

Lines of code Vulnerability details In Solidity, the "low-level call" operation, often used with inline assembly, is a powerful tool for interacting with external contracts. However, there is a specific bug related to low-level calls that can result in unexpected behavior. Instances 1: File:...

No way to revoke Approval in DelegateToken.approve leads to un authorized calling of DelegateToken.transferFrom

Lines of code Vulnerability details Impact There is no way to revoke the approval which given via DelegateToken.approveaddress,delegateTokenId. They can able call the DelegateToken.transferFrom even the tokenHolder revoke the permission using the DelegateToken.setApprovalForAll if the spender...

A malicious contract could steal assets via a flash loan

Lines of code Vulnerability details Impact A malicious contract could fail to return the assets, essentially stealing the Proof of Concept The key vulnerability is in the flashloan function. It transfers the assets to the receiver contract specified in info.receiver without any checks. Then it...

Unchecked return value of low level call()/delegatecall()

Lines of code Vulnerability details The vulnerability related to an "Unchecked return value of low-level call/delegatecall" is a common and critical issue in Ethereum smart contracts. Let's break down this vulnerability and discuss its implications: 1. Low-Level Calls in Solidity: In Solidity,...

The vulnerability of Google’s gRPC remote procedure call system allows a attacker to trigger a service failure.

The vulnerability of the Google gRPC process callouts is related to the lack of use of the assert function. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...