95 matches found
SUSE CVE-2018-13844
An issue has been found in HTSlib 1.8. It is a memory leak in fairead in faidx.c. NOTE: This has been disputed with the assertion that this vulnerability exists in the test harness and HTSlib users would be aware of the need to destruct this object returned by faiload in their own code...
SmartAccount implementation contract can be destroyed by anyone
Lines of code Vulnerability details SmartAccount implementation contract can be destroyed by anyone Impact Locking all user's funds forever due to DoS for all functions. Proof of Concept There are 2 main reasons for this vulnerability: 1. The expected behaviour of interacting with the...
Upgraded Q -> M from #506 [1670783534926]
Judge has assessed an item in Issue 506 as M risk. The relevant finding follows: selfDestruct will probably be deactivated soon --- The text was updated successfully, but these errors were encountered: All reactions...
Implementation can be self destruct by deployer, effectively break all running sale and lock all assets.
Lines of code Vulnerability details Impact Sale in Escher is deployed using minimal proxy pattern, where there is only 1 implementation contract is deployed to save deployment gas. Also, in Open Edition and FixedPrice sale, when sale is not started yet, owner can cancel it, self destruct the prox...
Denial Of Service (DoS)
evmos/ethermint is vulnerable to Denial Of Service DoS. The vulnerability exists in the deleteaccount function in statedb.go due to improper access control which allows an attacker to crash the system by sending a specially-crafted request using the self-destruct function...
Anyone can self-destruct this contract.
Lines of code Vulnerability details Impact High Unprotected call to a function executing selfdestruct/suicide. Proof of Concept DepositHandler.destroyaddress contracts/DepositHandler.sol28-30 allows anyone to destruct the contract. Once the contract is unlocked through the noReenter modifier,...
Vault implementation can be selfdestructed due to lack of initialization
Lines of code Vulnerability details Impact HIGH - Assets can be lost directly Anybody can initialize the Vault's implementation contract. The worst case would be to selfdestruct and make all the already deployed and to be deployed Vault's proxies useless and assets in the deployed proxies will be...
Uninitialized implementation for Vault can be destroyed
Lines of code Vulnerability details Impact Every Vault is a proxy of the same implementation contract. This implementation is deployed from VaultFactory but never initialized. /// @notice Initializes implementation contract constructor implementation = addressnew Vault; Someone can call init in t...
The vulnerability lies in the implementation of the __destruct() and dispatch($command) functions in the Laravel PHP framework, which allow a hacker to execute arbitrary code.
The vulnerability of implementing the destruct and dispatch$command functions in the Laravel PHP framework is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...
PT-2022-20661 · Laravel · Laravel
Name of the Vulnerable Software and Affected Versions: Laravel version 9.1.8 Description: The issue allows Remote Code Execution RCE via an unserialized pop chain in destruct in IlluminateBroadcastingPendingBroadcast.php and call in FakerGenerator.php when processing attacker-controlled data for...
CVE-2022-24916
Optimism before @eth-optimism/[email protected] allows economic griefing because a balance is duplicated upon contract self-destruction...
Directory traversal
The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248. After approximately two to four uses of the self-destruct feature, there is a misleading UI indication that an image was deleted on both the...
Telegram 安全漏洞
Telegram is an instant messaging mobile application. A security vulnerability exists in the Telegram applications 7.5.0 through 7.8.0 that stems from a misleading UI indication that an image has been deleted on both the sender's and receiver's sides after using the self-destruct feature...
Potential DOS in Contracts Inheriting UUPSUpgradeable.sol
Handle leastwood Vulnerability details Impact There are a number of contracts which inherit UUPSUpgradeable.sol, namely; GovernanceAction.sol, PauseRouter.sol and NoteERC20.sol. All these contracts are deployed using a proxy pattern whereby the implementation contract is used by the proxy contrac...
MacOS Flaw in Telegram Retrieves Deleted Messages
A vulnerability in a high-level privacy feature of Telegram on macOS that sets up a “self-destruct” timer for messages on both the sender’s and recipient’s devices can allow someone to retrieve these messages even after they’ve been deleted, a researcher has found. Reegun Richard Jayapaul,...
GLPI 9.5.3 Unsafe Reflection
Exploit Title: GLPI 9.5.3 - 'fromtype' Unsafe Reflection Date: 2021-02-13 Exploit Author: Vadym Soroka @Iterasec https://iterasec.com Vendor Homepage: https://glpi-project.org Software Link: https://github.com/glpi-project/glpi/releases Version: =9.5.3 Tested on:v9.5.3, 2021-02-13 Technical...
Mysterious Macintosh Malware
This is weird: Once an hour, infected Macs check a control server to see if there are any new commands the malware should run or binaries to execute. So far, however, researchers have yet to observe delivery of any payload on any of the infected 30,000 machines, leaving the malwares ultimate goal...
ALERT! Hackers targeting IoT devices with a new P2P botnet malware
Cybersecurity researchers have taken the wraps off a new botnet hijacking Internet-connected smart devices in the wild to perform nefarious tasks, mostly DDoS attacks, and illicit cryptocurrency coin mining. Discovered by Qihoo 360's Netlab security team, the HEH Botnet — written in Go language a...
VulnCheck KEV: CVE-2019-9081
The Illuminate component of Laravel Framework 5.7.x has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the PendingCommand class in PendingCommand.php...
