[PNM-005] Reentrancy of function sell

Lines of code Vulnerability details Description In function chargeFee, a potential reetrancy can be triggered by the factory. Since function sell invokes chargeFee in the middle of its function body, it potentially impacts the calculation, e.g., the totalSupply would be incorrect since the tokens...

MAL-2022-6829 Malicious code in usaa-axios-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55764e17e8e75cf7f02547f828d98aae791cd34ba49a468a9650dfe1e9e57ec6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in usaa-axios-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55764e17e8e75cf7f02547f828d98aae791cd34ba49a468a9650dfe1e9e57ec6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-arm-datafactory-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware afc9578f0a9b9c2a81182d4350c4538a9b3478ed151ac3f4c89f19dc1252b004 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Update now!  Microsoft patches Follina, and many other security updates

The June 2022 Patch Tuesday may go down in history as the day that Follina got patched, but there was a host of other important updates. And not just from Microsoft. Many other software vendors follow the pattern of monthly updates set by the people in Redmond. Microsoft Microsoft released update...

CVE-2022-20125

In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of privilege if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

CVE-2022-20125

In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of privilege if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

CVE-2022-20125

Technical details about CVE-2022-20125 are not publicly available in the provided documents. Monitor for updates.

zhanwangwipesfactory.com Cross Site Scripting vulnerability OBB-2647267

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ASB-A-194402515

In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of privilege if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2020-14496 Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A) - Permission Issues

Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to escalate privilege and execute malicious programs, which could cause a denial-of-service condition, and allow information ...

CVE-2020-14496 Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A) - Permission Issues

Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to escalate privilege and execute malicious programs, which could cause a denial-of-service condition, and allow information ...

CVE-2020-14496

CVE-2020-14496 is a permissions-based vulnerability in Mitsubishi Electric Factory Automation Engineering Software products. In affected products (e.g., CPU Module Logging Configuration Tool, CW/FR Configurators, EZSocket, GT Designer3, GX Works2/3, MELSOFT tools, Data Transfer, etc.), incorrect ...

gradle: information disclosure through temporary directory permissions

In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded...

nishida-factory.co.jp Cross Site Scripting vulnerability OBB-2618601

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Initialization function can be front-run

Lines of code Vulnerability details Impact The call to the initialize function can be front-run, and a malicious provider can be passed in and set to addressesProvider on any contract that inherits GeneralVault. This is significant because the onlyAdmin modifier checks if the msg.sender is...

GHSA-Q6X7-F33R-3WXX Incorrect Authorization in Apache Tomcat

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was...

The vulnerability of the external data integration driver Magnitude Simba Amazon Redshift ODBC in cloud services like Azure Data Factory and Azure Synapse allows a hacker to execute arbitrary code.

The vulnerability of the external data integration driver Magnitude Simba Amazon Redshift ODBC in cloud services like Azure Data Factory and Azure Synapse lies in the lack of authentication for the critical function. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

CVE-2022-27172

A hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted network request can lead to privileged operation execution. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2022-26002

A stack-based buffer overflow vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to remote code execution. An attacker can send a sequence of malicious packets to trigger this vulnerability...