121 matches found
Upgraded Q -> M from #236 [1669938261828]
Judge has assessed an item in Issue 236 as M risk. The relevant finding follows: It is possible the DAO determine the amount of commission very high for its own benefit, so setting a range for determining the commission seems logical. Especially MAX commission should be pre- defined. --- The text...
WEM - Exception: Failed to determine site for agent machine
WEM Agent does not get registered. Agent log 4:41:56 PM Exception - VuemAgentServiceConfigurationHelper.UpdateConfigurationSet : Failed to determine site for agent machine. 4:41:56 PM Exception - VuemAgentServiceConfigurationHelper.ReadRepositorySettings : Error happened while getting global...
Information disclosure
In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...
_harvest() vulnerable to sandwich attacks due to missing slippage checks
Lines of code Vulnerability details Impact All funds that should have been harvested can be taken via MEV sandwich attacks because there is no slippage control. Proof of Concept The two swap calls pass zero as the third argument: File: contracts/MyStrategy.sol 1 249 uint256 balEthBptEarned =...
execute() and executeWithBatch1155() functions are susceptible to DoS
Lines of code Vulnerability details Impact execute and executeWithBatch1155 are external functions. Both functions run for loops, boundary of which are determined by the function arguments. Anytime there's a loop where the input comes from an external source there's the possibility of unbounded...
Me on App Store Monopolies and Security
There are two bills working their way through Congress that would force companies like Apple to allow competitive app stores. Apple hates this, since it would break its monopoly, and its making a variety of security arguments to bolster its argument. I have written a rebuttal: I would like to...
The vulnerability of the character determination function in the implementation of the Unicode standard, related to errors in code generation using homoglyphs, allows a violator to execute arbitrary code.
The vulnerability of the character determination function in the implementation of the Unicode standard is related to errors in code generation using homoglyphs. Exploiting this vulnerability can allow a remote attacker to generate arbitrary codes...
The vulnerability of the `cdf_read_property_info` and `cdf_read_sat` functions in the utility for determining the type of specified files related to integer overflow allows an attacker to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the cdfreadpropertyinfo and cdfreadsat functions, which are used to determine the type of the specified files, is related to integer overflow. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and cause servic...
Crocus has an unauthorized access vulnerability
Crocus is an energy data analytics platform. An unauthorized access vulnerability exists in Crocus. An attacker can use the vulnerability to bypass permission determination to access functional pages...
IMF could track your browsing history to determine credit score
By Deeba Ahmed IMF researchers hinted at the possibility of using the user's browsing history, including search and purchasing data to determine the credit rating. This is a post from HackRead.com Read the original post: IMF could track your browsing history to determine credit score...
About the security content of macOS Catalina 10.15.5, Security Update 2020-003 Mojave, Security Update 2020-003 High Sierra - Apple Support
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...
CVE-2020-13227
An issue was discovered in Sysax Multi Server 6.90. An attacker can determine the username under which the web server is running by triggering an invalid path permission error. This bypasses the fakepath protection mechanism...
Data privacy law updates eyed by Singapore
In early 2019, Singapore’s data privacy regulators proposed that the country’s data privacy law could use two new updates—a data breach notification requirement and a right of data portability for the country’s residents. The proposed additions are commonplace in several data privacy laws around...
The vulnerability of the SQLite database management system, related to uncontrolled recursion, allows attackers to trigger a service failure.
The vulnerability of the SQLite database management system is related to a type determination error. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2019-10493
Position determination accuracy may be degraded due to wrongly decoded information in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640,...
Design/Logic Flaw
Position determination accuracy may be degraded due to wrongly decoded information in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640,...
CVE-2019-10493
CVE-2019-10493 is a critical flaw in Qualcomm closed‑source components used in Snapdragon devices (e.g., Auto/Compute/IoT/mobile/wearables). The issue degrades position determination accuracy due to wrongly decoded information across a long list of Snapdragon platforms (APQ8053, MDMs, SDMs, SXR, ...
CVE-2019-10493
Position determination accuracy may be degraded due to wrongly decoded information in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640,...
CVE-2019-10493: Buffer Copy without Checking Size of Input
Position determination accuracy may be degraded due to wrongly decoded information in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640,...
Unbreakable Enterprise kernel security update
kernel-uek 3.8.13-118.41.1 - x86/speculation: Determine swapgs before alternative instructions are set Patrick Colp Orabug: 30379626 - ieee802154: enforce CAPNETRAW for raw sockets Allen Pais Orabug: 30444947 CVE-2019-17053 - mISDN: enforce CAPNETRAW for raw sockets Ori Nimron Orabug: 30445159...