121 matches found
CVE-2022-36058 elrond-go MultiESDTNFTTransfer call on a SC address with missing function name
Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks historical or actual could encounter a MultiESDTNFTTransfer transaction like this: MultiESDTNFTTransfer with a missing function name. Basic functionality li...
GHSA-QF7J-25G9-R63F elrond-go MultiESDTNFTTransfer call on a SC address with missing function name
Impact Anyone who uses elrond-go to process blocks historical or actual that contains a transaction like this: MultiESDTNFTTransfer@01@54444558544b4b5955532d323631626138@00@0793afc18c8da2ca@ mind the missing function name after the last @ Basic functionality like p2p messaging, storage, API...
Duplicate
This advisory duplicates another...
Swivel.sol is missing authRedeem() function called in Marketplace.sol
Lines of code Vulnerability details Impact A user redeems or withdraws from their ZcToken by calling ZcToken.withdraw or ZcToken.redeem. Both of these functions then call MarketPlace.authRedeem which in turn calls Swivel.authRedeem. The issue is that Swivel.sol does not have an authRedeem functio...
CVE-2022-32053
TOTOLINK T6 V4.1.9cu.5179B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN0041621c...
CVE-2022-32051
TOTOLINK T6 V4.1.9cu.5179B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function FUN004133c4...
CVE-2022-32047
TOTOLINK T6 V4.1.9cu.5179B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN00412ef4...
USN-5348-3 smarty3 vulnerabilities
USN-5348-1 fixed several vulnerabilities in Smarty. This update provides the fixes for CVE-2021-21408, CVE-2021-26119, CVE-2021-26120 and CVE-2021-29454 for Ubuntu 20.04 ESM. Original advisory details: David Gnedt and Thomas Konrad discovered that Smarty was incorrectly sanitizing the paths prese...
CVE-2022-29398
TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the File parameter in the function FUN0041309c...
CVE-2022-29399
TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the url parameter in the function FUN00415bf0...
DEBIAN-CVE-2022-29078
The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...
CVE-2022-29078
The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...
UBUNTU-CVE-2022-29078
The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...
Github ejs 代码注入漏洞
Github ejs is an embedded JavaScript template. A code injection vulnerability exists in ejs version 3.1.6, which stems from server-side template injection being possible in settingsview optionsoutputFunctionName. This is parsed as an internal option and the outputFunctionName option is overridden...
PT-2022-3563
Name of the Vulnerable Software and Affected Versions ejs versions 3.1.6 Description The issue is related to the ejs package for Node.js, which allows server-side template injection in settingsview optionsoutputFunctionName. This can be parsed as an internal option and overwrites the...
PYSEC-2021-101
The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter...
PHP Code Injection by malicious function name in smarty
Template authors could inject php code by choosing a malicous function name. Sites that cannot fully trust template authors should update as soon as possible. Please upgrade to 3.1.39 or higher...
DEBIAN-CVE-2021-26120
Smarty before 3.1.39 allows code injection via an unexpected function name after a function name= substring...