Microsoft DWM Core Library 权限许可和访问控制问题漏洞

Microsoft DWM Core Library is the United States Microsoft Microsoft company's Microsoft windows get a core library. An elevation of privilege vulnerability exists in the Microsoft DWM Core Library. The vulnerability arises from an incorrect programmatic call to a high-level native procedure. An...

CVE-2022-28777

Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALLPHONE permission...

CVE-2022-28777

Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALLPHONE permission...

CVE-2022-28777

CVE-2022-28777 affects Samsung Members (pre-13.6.08.5). The issue is an improper access control that allows a local attacker to execute the call function without the CALL_PHONE permission. Remediation: update to version 13.6.08.5 or later. Evidence across connected documents confirms the vulnerab...

CVE-2022-28777

Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALLPHONE permission...

Cross-chain smart contract calls can revert but source chain tokens remain burnt and are not refunded

Lines of code Vulnerability details Impact Smart contract calls often revert. In such cases any ether sent along with the transaction is returned and sometimes the remaining gas depending on whether an assert caused the reversion or not. For contracts involving ERC20 tokens it is also expected...

Samsung Members 安全漏洞

Samsung Members is a community platform app from Samsung South Korea, Inc. An access control error vulnerability exists in versions prior to Samsung Members 13.6.08.5, which stems from a lack of proper access validation logic. A local attacker could exploit the vulnerability to execute the call...

PT-2022-19225 · Samsung · Samsung Members

Name of the Vulnerable Software and Affected Versions: Samsung Members versions prior to 13.6.08.5 Description: The issue is related to an improper access control vulnerability. It allows a local attacker to execute a call function without the required CALL PHONE permission. Recommendations: For...

PT-2022-6752 · Avahi +9 · Avahi +9

Name of the Vulnerable Software and Affected Versions: avahi affected versions not specified Description: A flaw in the avahi library allows an unprivileged user to make a dbus call, causing the avahi daemon to crash. This issue is related to an uncontrolled resource consumption, which can be...

Arbitrary contract call within UniV3LpVault._swap with controllable swapPath

Lines of code Vulnerability details Impact UniV3LpVault.swap utilizes swapRouter.exactInput to perform swaps between two tokens. During swaps, transfer function of each token along the path will be called to propagate the assets. Since anyone can create a uniswap pair of arbitrary assets, it is...

The vulnerability of the vcf_parse_format function in the library allows access to common file formats used by HTSlib. This enables attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the vcfparseformat function in the library, which allows access to common file formats in HTSlib, lies in the check that only individual fields have excessive sizes. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity...

CVE-2021-41752

Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recursive call to the new opt function...

CVE-2021-41752

Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recursive call to the new opt function...

Stack overflow

Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recursive call to the new opt function...

UBUNTU-CVE-2022-27649

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby Docker Engine, where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to...

CVE-2022-1018 ICSA-22-088-01 Rockwell Automation ISaGRAF

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of...

Any User Can Call incrementWindow() by Using a Spoofed Contract

Lines of code Vulnerability details Impact The incrementWindow function is used to notify the splitter contract whenever funds are sent to the contract. Users who belong to the merkle tree are able to claim their set percentage allocation on each new window. However, it is possible to spoof a cal...

The vulnerability of the printIFDStructure function in the image.cpp component of the Exiv2 media metadata management library allows a attacker to cause a service failure.

The vulnerability of the printIFDStructure function in the image.cpp component of the Exiv2 media metadata management library is related to the recursive call to a function. Exploiting this vulnerability allows an attacker to trigger a service failure using a specially created file...

openSUSE 15 Security Update : protobuf (openSUSE-SU-2022:1040-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:1040-1 advisory. - Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto...

SUSE SLED15: libprotobuf-lite20 / libprotobuf20 / libprotoc20 / protobuf-devel / etc (SUSE-SU-2022:1040-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1040-1 advisory. - CVE-2021-22570: Fix incorrect parsing of nullchar in the proto symbol bsc1195258. Tenable has extracted the preceding...