Upgraded Q -> M from 47 [1655572104366]

Judge has assessed an item in Issue 47 as Medium risk. The relevant finding follows: 1. Unsafe use of transfer/transferFrom with IERC20 Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example Tether USDT's transfer and...

Panic on incorrect date input to `simple_asn1`

Version 0.6.0 of the simpleasn1 crate panics on certain malformed inputs to its parsing functions, including fromder and derdecode. Because this crate is frequently used with inputs from the network, this should be considered a security vulnerability. The issue occurs when parsing the old ASN.1...

GHSA-GFG9-X6PX-R7GR Library exclusively intended to obfuscate code.

This crate allows you to write safe functions with unsafe bodies without the unsafe keyword. The value this adds is questionable, and hides unsafe usages from naive analysis...

Library exclusively intended to obfuscate code.

This crate allows you to write safe functions with unsafe bodies without the unsafe keyword. The value this adds is questionable, and hides unsafe usages from naive analysis...

BuddyPress Group Reviews < 2.8.4 - Subscriber+ Arbitrary Settings Update & Review Modification

The plugin is missing capability and CSRF checks in various of its AJAX functions available to any authenticated users, which could allow users with a role as low as subscriber to update arbitrary settings and modify reviews...

CVE-2021-41403

flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities...

CVE-2021-41403

flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities...

CVE-2021-41403

flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities...

Siemens SICAM GridEdge Authentication Error Vulnerability (CNVD-2022-45216)

SICAM GridEdge enables IoT functionality in your existing IEC 61850 devices with just a few clicks.An authentication error vulnerability in Siemens SICAM GridEdge results from the fact that the affected software does not authenticate access to privileged functions, which can be exploited to creat...

WordPress Member Hero plugin code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

CVE-2022-30229

A vulnerability has been identified in SICAM GridEdge Classic All versions V2.6.6. The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to change data of a user, such as credentials, in case that user's id is known...

CVE-2022-30230

A vulnerability has been identified in SICAM GridEdge Classic All versions V2.6.6. The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to create a new user with administrative permissions...

Design/Logic Flaw

A vulnerability has been identified in SICAM GridEdge Essential ARM All versions V2.6.6, SICAM GridEdge Essential Intel All versions V2.6.6, SICAM GridEdge Essential with GDS ARM All versions V2.6.6, SICAM GridEdge Essential with GDS Intel All versions V2.6.6. The affected software does not requi...

CVE-2021-35120

Improper handling between export and release functions on the same handle from client can lead to use after free in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile...

CVE-2022-30229

A vulnerability has been identified in SICAM GridEdge Classic All versions V2.6.6. The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to change data of a user, such as credentials, in case that user's id is known...

MAL-2022-6313 Malicious code in storage-image-processing-api-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd5fe1baa5d2f967fe24f1b3fdde3e077e889cdf7fc65c779ecd2a002bb2de8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Siemens SICAM GridEdge Essential 授权问题漏洞

SICAM GridEdge enables IoT functionality in your existing IEC 61850 devices with just a few clicks.Siemens SICAM GridEdge is vulnerable to an authentication error, which stems from the fact that the affected software does not require authenticated access to privileged functions and can be exploit...

Siemens SICAM GridEdge Essential 访问控制错误漏洞

SICAM GridEdge enables IoT functionality in your existing IEC 61850 devices with just a few clicks.An authentication error vulnerability in Siemens SICAM GridEdge results from the fact that the affected software does not authenticate access to privileged functions, which can be exploited to creat...

CVE-2022-1656

Vulnerable versions of the JupiterX Theme =2.0.6 allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterxapiajax actions registered by the JupiterX Core Plugin =2.0.6. This includes the...

CVE-2022-0885

The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments...