JBoss Keycloak CSRF Vulnerability

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery CSRF attacks by leveraging lack of CSRF protection...

Moodle Unauthenticated users can trigger custom messages to admin via paypal enrol script

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was...

Cross-site Scripting (XSS)

org.wso2.carbon.identity.mgt.endpoint.util is vulnerable to cross-site scripting. The vulnerability exists due to the lack of regular expression validation in the localVarPath parameter in the recover function of PasswordRecoveryApiV1.java, allowing an attacker to inject and execute malicious...

PT-2025-41015

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s perf/smmuv3 component related to a hotplug callback leak within the arm smmu pmu init function. Specifically, the function fails to remove a callback...

Users Can Prevent Excess Tokens From Being Withdrawn By The Pool Creator In withdrawExcessRewards()

Lines of code Vulnerability details Impact Because pools will likely never be fully utilised by stakers while active, the following assumption in withdrawExcessRewards can be broken by preventing any receipt withdrawal: requirepool.totalDepositsWei == 0, 'Cannot withdraw until all deposits are...

DEBIAN-CVE-2022-29967

staticcompressedinmemorywebsitecallback.c in Glewlwyd through 2.6.2 allows directory traversal...

UBUNTU-CVE-2022-29967

staticcompressedinmemorywebsitecallback.c in Glewlwyd through 2.6.2 allows directory traversal...

Glewlwyd 路径遍历漏洞

Glewlwyd is a single sign-on SSO server for multi-factor authentication for OAuth2 and OpenID Connect authentication. A security vulnerability exists in Glewlwyd version 2.6.2 and earlier versions, which stems from staticcompressedinmemorywebsitecallback.c that allows directory traversal...

Unsafe use of .transfer

Lines of code Vulnerability details Impact User funds can be locked by using a smart contract wallet with inefficient callback, or by future hardforks that change the gas consumption. address.transfer has been suggested to deprecate by most auditors, because of the potential OOG error. However,...

Customers cannot redeem() LP tokens to non-EOA accounts

Lines of code Vulnerability details The use of payable.transfer is heavily frowned upon because it can lead to the locking of funds. The transfer call requires that the recipient has a payable callback, only provides 2300 gas for its operation. This means the following cases can cause the transfe...

DEBIAN-CVE-2022-24883

FreeRDP is a free implementation of the Remote Desktop Protocol RDP. Prior to version 2.7.0, server side authentication against a SAM file might be successful for invalid credentials if the server has configured an invalid SAM file path. FreeRDP based clients are not affected. RDP server...

UBUNTU-CVE-2022-24883

FreeRDP is a free implementation of the Remote Desktop Protocol RDP. Prior to version 2.7.0, server side authentication against a SAM file might be successful for invalid credentials if the server has configured an invalid SAM file path. FreeRDP based clients are not affected. RDP server...

GSD-2022-1001893 arm64: prevent instrumentation of bp hardening callbacks

arm64: prevent instrumentation of bp hardening callbacks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

CVE-2021-4212

A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2021-4210

A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code...

Code injection

A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code...

Code injection

A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code...

Code injection

A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2021-4212

CVE-2021-4212 describes a local-privilege escalation vulnerability in the SMI callback function used by the Legacy BIOS mode driver on some Lenovo Notebook models. The issue could allow an attacker with local access and elevated privileges to execute arbitrary code. The affected component is the ...

CVE-2021-4211

A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code...