Insecure password leads to Mangatoon data breach

The hugely popular Manga comics platform Mangatoon has fallen victim to a data breach. No fewer than 23 million user accounts could be at risk, thanks to a poorly secured database. Worse still, Mangatoon doesnt seem to be responding to messages from the breacher, or people notifying it that the...

Oracle Linux 7 : olcne (ELSA-2022-9587)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9587 advisory. - Adress Istio CVE-2022-31045, CVE-2022-29225, CVE-2022-29224,CVE-2022-29226,CVE-2022-29228,CVE-2022-29227 - Address qemu CVE-2022-26353, CVE-2021-3748...

Oracle Linux 8 : olcne (ELSA-2022-9586)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9586 advisory. - Adress Istio CVE-2022-31045, CVE-2022-29225, CVE-2022-29224,CVE-2022-29226,CVE-2022-29228,CVE-2022-29227 - Address qemu CVE-2022-26353, CVE-2021-3748...

Google Android Information Disclosure Vulnerability (CNVD-2022-61748)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an information disclosure vulnerability caused by a lack of The vulnerability is caused by a lack of permission checking in the getSubscriptionProperty of SubscriptionController.java. An...

Exploit for NULL Pointer Dereference in Linux Linux_Kernel

CVE-2022-23222 Click here if you just wanna build and run th...

latestRoundData should have returned value checks

Lines of code Vulnerability details Impact when we use the latestRoundData we should always check the returned value because it may return stale data. , int256 price, , , = feed.latestRoundData; Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any...

Google Android Remote Code Execution Vulnerability (CNVD-2022-57609)

Google Android System is a remote code execution vulnerability in Google Android System, a Linux-based open source operating system from Google, Inc. The vulnerability stems from a lack of boundary checking, which could lead to out-of-bounds writes. An attacker could exploit this vulnerability to...

Multiple MediaTek Chip WLAN Driver Input Validation Error Vulnerability

MediaTek Inc. is the world's fourth largest fab-based semiconductor company and a leader in the markets of mobile terminals, smart home applications, wireless connectivity and Internet of Things IoT products, with approximately 1.5 billion units of end products with built-in MediaTek chips hittin...

Multiple MediaTek chips audio DSP input validation error vulnerability

MediaTek Inc. is the world's fourth largest fab-based semiconductor company and a leader in the markets of mobile terminals, smart home applications, wireless connectivity and Internet of Things IoT products, with approximately 1.5 billion units of end products with built-in MediaTek chips hittin...

Failed transfer during migrate could lockup the fund in old terminal

Lines of code Vulnerability details Without require for boolean checking, if to.addToBalanceOfvalue: payableValueprojectId, balance, token, '', bytes''; fail when transfer, migrate will not revert. This could cause the fund to lockup in the old terminal since store.recordMigrationprojectId; will...

MediaTek 芯片缓冲区错误漏洞

MediaTek chips are a variety of chips from MediaTek, a Chinese company called MediaTek. A security vulnerability exists in MediaTek's WLAN driver, which stems from a lack of boundary checking, leading to out-of-bounds writes. An attacker could exploit the vulnerability to escalate privileges...

The vulnerability in the implementation of the util.printf() function allows attackers to execute arbitrary code in PDF viewer and editor applications like Adobe Reader and Adobe Acrobat.

The vulnerability of the util.printf function in PDF viewing and editing applications like Adobe Reader and Adobe Acrobat arises from the execution of operations outside of the buffer in memory, due to improper parameter checking. Exploiting this vulnerability allows a malicious actor to execute...

GO-2022-0386 Import token permissions checking not enforced in github.com/nats-io/jwt

Import tokens valid for one account may be used for any other account. Validation of Import token bindings incorrectly warns on mismatches, rather than rejecting the Goken. This permits a token for one account to be used for any other account...

The vulnerability of the trusted loading module in Intel microprogrammed system BIOS allows a hacker to enhance their privileges.

The vulnerability of the trusted loading module in Intel microprogramming system BIOS is related to insufficient checking of input data. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the BIOS microprogramming system of Intel processors allows a hacker to gain unauthorized access to protected information.

The vulnerability of the BIOS microprogramming system of Intel processors is related to incorrect checking of the return value. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

GSD-2022-1003214 USB: host: isp116x: check return value after calling platform_get_resource()

USB: host: isp116x: check return value after calling platformgetresource This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.47 by commit...

Nextcloud: SSRF via potential filter bypass with too lax local domain checking

Summary: Hi. Reviewing the code for filtering for ssrf, in preventLocalAddress, we can see that it calls the function ThrowIfLocalAddress. It has three common checks, first, it checks if the string is localhost, or if it ends in .local or .localhost php // Disallow localhost and local network if...

Operator may be removed without checking whether are there fund locked in that operator.

Lines of code Vulnerability details Impact Operator may be removed without checking whether are there fund locked in that operator. Locked fund may not be able to withdraw unless operator is being added back. Proof of Concept /// @inheritdoc INestedFactory function removeOperatorbytes32 operator...

Cross-site Scripting (XSS)

facturascripts/facturascripts is vulnerable to cross-site scripting. Lack of checking for file types for downloads before reading files allows an attacker to inject and execute malicious scripts...

Google Android Information Disclosure Vulnerability (CNVD-2022-62203)

Google Android is a Linux-based open source operating system from Google, Inc. Bootloader is one of the bootloaders. The vulnerability stems from incorrect boundary checking, which could lead to out-of-bounds reads. An attacker could exploit the vulnerability to obtain sensitive information...