CVE-2023-21643

CVE-2023-21643 involves memory corruption due to an untrusted pointer dereference in automotive systems during a system call. The core vulnerability is a pointer dereference leading to memory corruption in an automotive context, with both NVD’s local access impact (CVSSv3.1: base 7.8, HIGH/LOCAL)...

CVE-2023-21627

CVE-2023-21627 is a memory corruption issue in the Trusted Execution Environment when a service API is called with an invalid address. The vulnerability affects Qualcomm components (TEE) and is documented in multiple feeds, with the NVD/NIST entry noting memory corruption and a base CVSS v3.1 sco...

CVE-2022-40510

The CVE-2022-40510 issue affects Qualcomm closed-source audio components during EVS-based voice calls. Root cause: memory corruption from a buffer copy that does not validate input size when processing audio. Impact, as stated: high confidentiality, integrity, and availability implications with n...

Qualcomm Chip Buffer Error Vulnerability

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc. and are often manufactured on the surface of semiconductor wafers. The Qualcomm chip suffers from a security vulnerability that stems from memory...

PT-2023-18307 · Qualcomm · Snapdragon +19

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption due to an untrusted pointer dereference in automotive systems during a system call. This can potentially lead to...

FCC comes down hard on robocallers with record $300m fine

Robocallers are in the news after the FCC issued a $300 million forfeiture to a persistent offender and shut down their operation. A robocall network makes use of automated software diallers to spam out large numbers of cold calls to unsuspecting recipients. These calls promise much but give very...

Xxe

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

CONTROLLED LOW-LEVEL CALL

Lines of code Vulnerability details Impact The contract was using call which was accepting address controlled by a user. This can have devastating effects on the contract as a delegate call allows the contract to execute code belonging to other contracts but using it’s own storage. This can very...

RETURN VALUE OF LOW LEVEL call FUNCTION IS NOT CHECKED FOR SUCCESFUL VALUE TRANSFER

Lines of code Vulnerability details Impact The V3Proxy.swapTokensForExactETH and V3Proxy.swapExactTokensForETH functions use the low level call function to transfer Eth to the msg.sender as shown below: payablemsg.sender.callvalue: amountOut""; But there is no verification of the return value of...

Unchecked Call Return Value

Lines of code Vulnerability details Impact The functions do not check the return value of low-level calls. This can lock Ether in the contract if the call fails or may compromise the contract if the ownership is being changed. The following calls were detected without return value validations -...

Authorization Bypass

gitlab is vulnerable to Authorization Bypass. The vulnerability exists because of an instance that has the setting to disable Bitbucket Server import enabled allowing an attacker to bypass by making a crafted API call...

Command Injection

snapd is vulnerable to Command Injection. The vulnerability exists in the IOCTL system call handler due to lack of parameter checks which allows an attacker to inject and execute arbitrary commands...

The USDOMarketModule contract's lend function allows for dangerous call delegation

Lines of code Vulnerability details Impact The USDOMarketModule contract is a module that is used by the BaseUSDO contract to facilitate functionality for market actions. The module functionality is invoked through the invocation of a delegatecall within the BaseUSDO contract's executeModule...

The USDOLeverageModule contract's leverageUp function allows for dangerous call delegation

Lines of code Vulnerability details Impact The USDOLeverageModule contract is a module that is used by the BaseUSDO contract to facilitate functionality for leverage actions. The module functionality is invoked through the invocation of a delegatecall within the BaseUSDO contract's executeModule...

_sendToken in tapiocaz::Balancer::rebalance() not sending native fee will lead to revert

Lines of code Vulnerability details Impact function sendToken address payable oft, uint256 amount, uint16 dstChainId, uint256 slippage, bytes memory data private IERC20Metadata erc20 = IERC20MetadataITapiocaOFToft.erc20; if erc20.balanceOfaddressthis amount revert ExceedsBalance; uint256 srcPoolI...

The vulnerabilities of SAP NetWeaver AS ABAP and SAP NetWeaver ABAP software integration platforms are related to deficiencies in authentication procedures. These deficiencies allow attackers to circumvent security restrictions, enhance their privileges, and gain unauthorized access to protected information.

The vulnerability of SAP NetWeaver AS ABAP and SAP NetWeaver ABAP integration platforms is related to deficiencies in the authentication process due to incorrect processing of user information via RFC messages, thereby compromising the security between SAP systems. Exploiting this vulnerability...

EulerOS Virtualization 2.10.1 : avahi (EulerOS-SA-2023-2534)

According to the versions of the avahi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon...

EulerOS Virtualization 2.10.0 : avahi (EulerOS-SA-2023-2553)

According to the versions of the avahi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon...

Potential Loss of Rewards During Token Transfers in StaticATokenLM.sol

Lines of code Vulnerability details Impact This issue could lead to a permanent loss of rewards for the transferer of the token. During the token transfer process, the beforeTokenTransfer function updates rewards for both the sender and the receiver. However, due to the specific call order and th...

Huawei EulerOS: Security Advisory for avahi (EulerOS-SA-2023-2521)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...