Vulnerabilities fixed in WhatsApp

Two vulnerabilities have been fixed in WhatsApp. The vulnerability with reference CVE-2022-36934 allows a remote malicious person to able to execute arbitrary code during a video call. The vulnerability with attribute CVE-2022-27492 allows a remote malicious person to remotely able to execute...

CVE-2022-3024 Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS

The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored...

Nextcloud: XSS in Desktop Client in call notification popup

Summary: The Nextcloud Desktop Client application does not properly neutralize the name of a group conversation before using it. Steps To Reproduce: Server Machine: 1. Install the Nextcloud Server application 2. Create an administrator account 3. Create a user account Client Machine: 4. Install t...

Low level call returns true if the address doesn't exist

Lines of code Vulnerability details Impact As written in the solidity documentation, the low-level function call returns true as its first return value if the address called is non-existent, as part of the design of the EVM. Address existence must be checked prior to calling if needed. Since the...

CVE-2022-36025

Besu (Java-based Ethereum client) contains a numeric conversion bug in gas calculation for CALL/DELEGATECALL, affecting versions after 22.1.3 and before 22.7.1. The error in 32-bit signed/unsigned arithmetic can pass incorrect gas to called contracts and return gas, potentially causing a differin...

CVE-2022-36025 Incorrect Conversion between Numeric Types in Besu Ethereum Client

Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in...

Hyperledger Besu 安全漏洞

Hyperledger Besu is an open source application from Hyperledger. It is used to run, maintain, debug and monitor nodes in the Ethernet network. A security vulnerability exists in Hyperledger Besu versions prior to 22.1.3 through 22.7.1, which stems from an error in its 32-bit signed and unsigned...

Besu VM vulnerable to gas allocation error in CALL operations

Impact An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in th...

GHSA-4456-W38R-M53X Besu VM vulnerable to gas allocation error in CALL operations

Impact An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in th...

OESA-2022-1942 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: Non-transparent sharing of return predictor targets between contexts in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access.CVE-2022-26373 A heap-based buffer overflow...

OESA-2022-1943 flink security update

Apache Flink is a framework and distributed processing engine for stateful computations over unbounded and bounded data streams. Flink has been designed to run in all common cluster environments, perform computations at in-memory speed and at any scale. Security Fixes: Apache Log4j2 2.0-beta9...

PT-2022-23124 · Besu · Besu

Name of the Vulnerable Software and Affected Versions: Besu versions 22.1.4 through 22.7.0 Description: The issue is related to an incorrect conversion between numeric types in the calculation of available gas in CALL operations, including DELEGATECALL. This results in incorrect gas being passed...

HashiCorp Consul 安全漏洞

HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp USA. The product is used to connect and configure applications across dynamically distributed infrastructures. A security vulnerability exists in HashiCorp Consul versions 1.8.1, 1.11.81.12.4,...

Linux kernel 缓冲区错误漏洞

The Linux kernel is an open source Unix-like operating system macro kernel for efficient resource management. A security vulnerability exists in the Linux Kernel where constants used to populate pointers in structures passed to bpfsysbpf are unverified and can point anywhere, and an attacker with...

CVE-2022-36934

An integer overflow in WhatsApp could result in remote code execution in an established video call...

CVE-2022-36934

An integer overflow in WhatsApp could result in remote code execution in an established video call...

Integer overflow

An integer overflow in WhatsApp could result in remote code execution in an established video call...

CVE-2022-36934

An integer overflow in WhatsApp could result in remote code execution in an established video call...

Upgraded Q -> M from 238 [1663858577471]

Judge has assessed an item in Issue 238 as Medium risk. The relevant finding follows: 2. call should be used instead of transfer on an address payable Sometimes this kind of issue is considered as Medium risk. The use of the deprecated transfer function for an address will inevitably make the...

PT-2022-23690 · Whatsapp · Whatsapp

Name of the Vulnerable Software and Affected Versions: WhatsApp affected versions not specified Description: An integer overflow in WhatsApp could result in remote code execution in an established video call. The issue affects WhatsApp mobile apps. Recommendations: At the moment, there is no...