3928 matches found
CVE-2021-4305 Woorank robots-txt-guard patterns.js makePathPattern redos
A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib/patterns.js. The manipulation of the argument pattern leads to inefficient regular expression complexity. The exploit has been disclosed ...
EXTERNAL CALL TO UNTRUSTED PARTIES
Lines of code Vulnerability details Impact Functions in this contract or inherited functions can be reentered. Proof of Concept In Vault.sol the withdrawAVAX and redeemAVAX functions make an external call to the msg.sender by way of safeTransferETH. This allows the caller to reenter this and othe...
Friday Squid Blogging: Grounded Fishing Boat Carrying 16,000 Pounds of Squid
Rough seas are hampering efforts to salvage the boat: The Speranza Marie, carrying 16,000 pounds of squid and some 1,000 gallons of diesel fuel, hit the shoreline near Chinese Harbor at about 2 a.m. on Dec. 15. Six crew members were on board, and all were rescued without injury by another fishing...
Missing ReEntrancy Guard to executeAcceptBidWithCredit function
Lines of code Vulnerability details Impact if the mint was initiated by a contract, then the contract is checked for its ability to receive ERC721 tokens. Without reentrancy guard, onERC721Received will allow an attacker controlled contract to call the mint again, which may not be desirable to so...
MGASA-2022-0439 Updated tumbler packages fix security vulnerability
gst-thumbnailer: Add mime type check gxoxfce/tumbler65 desktop-thumbnailer: Guard against null path Fix typo in gthread version gxoxfce/tumbler!14...
PT-2022-37583 · Tumbler · Tumbler
Name of the Vulnerable Software and Affected Versions: tumbler affected versions not specified Description: The issue concerns a lack of mime type check and a null path guard in the desktop-thumbnailer, as well as a typo in the gthread version. Recommendations: At the moment, there is no...
OPENSUSE-SU-2022:10207-1 Security update for tumbler
This update for tumbler fixes the following issues: tumbler was updated to version 4.16.1 boo1205210 gst-thumbnailer: Add mime type check gxoxfce/tumbler65 desktop-thumbnailer: Guard against null path Fix typo in gthread version gxoxfce/tumbler!14...
hw: cpu: information disclosure via Intel Software Guard Extensions (SGX) Platform
A flaw was found in hw. Sensitive information accessible by physical probing of the JTAG interface for some IntelR Processors with SGX may allow an unprivileged user to disclose information via physical access...
Recipients Can Steal Remaining ETH from Exchange
Lines of code Vulnerability details Impact This vulnerability allows recipients to reenter the Exchange contract, stealing remaining ETH. When a batch of orders are matched using the bulkExecute method a malicious recipient of assets may reenter the bulkExecute method, stealing ETH that would've...
internalCall modifier can be circumvented with execute / bulkExecute
Lines of code Vulnerability details Impact The internalCall modifier ensures that public functions can only be called from another public function and not directly. It is implemented like that: modifier internalCall requireisInternal, "This function should not be called directly"; ; The modifier...
PT-2022-18457 · Intel · Intel Sgx Sdk
Name of the Vulnerable Software and Affected Versions: IntelR SGX SDK software affected versions not specified Description: The issue is related to the premature release of a resource during its expected lifetime, which may allow a privileged user to potentially enable information disclosure via...
Intel SGX SDK 安全漏洞
Intel SGX SDK is a set of software development kits based on SGX Intel Software Security Extensions technology from Intel Corporation USA. A security vulnerability exists in the Intel SGX SDK software that stems from prematurely releasing resources, which could allow a privileged user to...
Robin Banks Phishing Service for Cybercriminals Returns with Russian Server
A phishing-as-a-service PhaaS platform known as Robin Banks has relocated its attack infrastructure to DDoS-Guard, a Russian provider of bulletproof hosting services. The switch comes after "Cloudflare disassociated Robin Banks phishing infrastructure from its services, causing a multi-day...
WordPress Backup Guard plugin <= 1.6.9.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Muhammad Daffa Patchstack Alliance in the WordPress Backup Guard plugin versions = 1.6.9.0. Solution Update the WordPress Backup Guard plugin to the latest available version at least 1.6.9.1...
The vulnerability of the QNAP QVR Elite, QVR Pro, and the QVR Guard application for managing emergency switching in video surveillance systems lies in the recording of data beyond the buffer in memory, allowing a intruder to execute arbitrary code.
The vulnerability of QNAP QVR Elite, QVR Pro, and the QVR Guard application, which is used for managing emergency switching of video surveillance systems, lies in data recording beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...
The vulnerability of the QNAP QVR Elite, QVR Pro, and the QVR Guard application for managing emergency switching in video surveillance systems lies in the recording of data beyond the buffer in memory, allowing a intruder to execute arbitrary code.
The vulnerability of QNAP QVR Elite, QVR Pro, and the QVR Guard application, which is used for managing emergency switching of video surveillance systems, lies in data recording beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...
The vulnerability of the QNAP QVR Elite, QVR Pro, and the QVR Guard application for managing emergency switching in video surveillance systems lies in the recording of data beyond the buffer in memory, allowing a intruder to execute arbitrary code.
The vulnerability of QNAP QVR Elite, QVR Pro, and the QVR Guard emergency switching management application relates to data recording beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
CVE-2021-27862
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion and optionally VLAN0 headers...