CVE-2023-22436

The kernel subsystem function checkpermissionforsettokenid within OpenHarmony-v3.1.5 and prior versions has an UAF vulnerability which local attackers can exploit this vulnerability to escalate the privilege to root...

SUSE CVE-2014-7939

Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header...

FBI Says North Korean Hackers Behind $100 Million Horizon Bridge Crypto Theft

The U.S. Federal Bureau of Investigation FBI on Monday confirmed that North Korean threat actors were responsible for the theft of $100 million in cryptocurrency assets from Harmony Horizon Bridge in June 2022. The law enforcement agency attributed the hack to the Lazarus Group and APT38, the...

HUAWEI EMUI/Magic UI 资源管理错误漏洞

Huawei EMUI is a mobile operating system developed based on Android.Huawei HarmonyOS is to provide a full-scenario distributed operating system based on microkernel. A double release vulnerability exists in Huawei EMUI and HarmonyOS, which can be exploited by an attacker to cause a denial of...

CVE-2022-45877

OpenHarmony-v3.1.4 and prior versions had an vulnerability. PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks...

CVE-2022-43451

OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape application sandbox.If chained with other vulnerabilities it would allow an unprivileged process to gain full root...

PT-2022-26025 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions 3.1.2 and prior OpenHarmony versions 3.0.6 and prior Description: The issue is related to an Out-of-bound memory read and write vulnerability in the /dev/mmz userdev device driver. The impact depends on the privileges of...

PT-2022-23361 · Unknown +1 · Openharmony +1

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 3.1.2 Description: The issue is caused by an incorrect configuration of the cJSON library, leading to a stack overflow vulnerability during recursive parsing. This allows LAN attackers to launch a Denial of Servi...

harmonyblindsofnorthlondon.co.uk Cross Site Scripting vulnerability OBB-2841997

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

holisticharmonymindbodysoul.com.au Cross Site Scripting vulnerability OBB-2832356

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

U.S. Offers $10 Million Reward for Information on North Korean Hackers

The U.S. State Department has announced rewards of up to $10 million for any information that could help disrupt North Korea's cryptocurrency theft, cyber-espionage, and other illicit state-backed activities. "If you have information on any individuals associated with the North Korean...

Hackers Exploit Harmony’s Horizon Blockchain Bridge to Steal $100 Million

By Deeba Ahmed The main bridge of layer-1 blockchain between Binance Chain, Ethereum, and Bitcoin was exploited, but the BTC bridge… This is a post from HackRead.com Read the original post: Hackers Exploit Harmony’s Horizon Blockchain Bridge to Steal $100 Million...

@codingsh/harmony-crypto (>=0.1.57, <=0.1.58) potentially affected by unknown CVE via scrypt-shim (0.0.1-security)

scrypt-shim NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on scrypt-shim and may be impacted: - @codingsh/harmony-crypto =0.1.57, =0.1.58 Source cves: unknown CVE Source advisory: OSV:MAL-2022-5972...

Malicious code in spotify-harmony (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 640dc23747e57ed5934bf04912735a12ae2e408bd0eb2d3abaca3ab0fc264026 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6256 Malicious code in spotify-harmony (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 640dc23747e57ed5934bf04912735a12ae2e408bd0eb2d3abaca3ab0fc264026 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Check Point Response to CVE-2022-21449 - Java "Psychic Signatures"

Symptoms - On April 20, 2022, security researcher Neil Madden published a blog post in which he provided details about a newly disclosed vulnerability in Java, CVE-2022-21449 or "Psychic Signatures". This security vulnerability originates in an incorrect implementation of the ECDSA signature...

‘Cities: Skylines’ Gaming Modder Banned Over Hidden Malware

The developer of several popular mods for the Cities: Skylines city-building game has been banned after malware was discovered hidden in their wares. The modder, who goes by the handle Chaos as well as Holy Water, reportedly tucked an automatic updater into several mods that enabled the author to...

CVE-2021-22817

A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series All Versions, Vijeo Designer All Versions prior to V6.2 SP11 Multiple HotFix 4,...

CVE-2021-22817

A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series All Versions, Vijeo Designer All Versions prior to V6.2 SP11 Multiple HotFix 4,...

CVE-2021-22817

A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series All Versions, Vijeo Designer All Versions prior to V6.2 SP11 Multiple HotFix 4,...