1226 matches found
Google Android 输入验证错误漏洞
Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android, which stems from a faulty access control vulnerability in the camera before Android R11, Android Q10 and Android P9. that allows untrusted applications to take picture...
GSD-2022-1000008 faker.js 6.6.6 is broken and the developer has wiped the original GitHub repo
faker.js had it's version updated to 6.6.6 in NPM which reports it as having 2,571 dependent packages that rely upon it and the GitHub repo has been wiped of content. This appears to have been done intentionally as the repo only has a single commit so it was likjely deleted, recreated and a singl...
GSD-2022-1000007 colors.js 1.4.1 has an infinite loop added by the primary developer
colors.js had an infinite loop added by the primary developer in version 1.4.1 and 6.6.6 which was released on GitHub and NPM which reports it as having 3,179 dependent packages that rely upon it. Additionally the GitHub repo was wiped of all files. This appears to have been done intentionally in...
Unchecked return value from low-level call()
Handle JMukesh Vulnerability details Impact The return value of the low-level call is not checked, so if the call fails, the Ether will be locked in the contract. If the low level is used to prevent blocking operations, consider logging failed calls. Proof of Concept Tools Used manual review...
Mozilla Firefox conditional competition issue vulnerability
Mozilla Firefox is an open source Web browser from the Mozilla Foundation. Mozilla Firefox is vulnerable to a conditional competition issue, which could be exploited by an attacker to force a notification to receive full-screen and pointer-locked access to the page...
Hotel claims Conti ransomware attack on system as guests locked out
By Deeba Ahmed So far, the Conti ransomware has not demanded any ransom or published any details of the ransomware attack. This is a post from HackRead.com Read the original post: Hotel claims Conti ransomware attack on system as guests locked out...
The vulnerability of iOS operating systems, related to deficiencies in authentication procedures, allows a perpetrator to activate the Apple Pay transaction card on a locked or drained phone.
The vulnerability of iOS operating systems is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to enable the Apple Pay payment card on a locked or drained phone using a static 15-byte string...
Google Android 资源管理错误漏洞
Google Android is a Linux-based open source operating system from Google, Inc. The vulnerability stems from a post-release reuse and out-of-bounds write vulnerability in setClientStateLocked in SurfaceFlinger.cpp. An attacker could exploit the vulnerability to cause a local privilege escalation...
kernel: powerpc: RTAS calls can be used to compromise kernel integrity
A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down usually due to Secure Boot guest system running on top of PowerVM or KVM hypervisors pseries platform a root like local user could use this flaw to further increase their privileges to...
Improper access control
An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestion...
CVE-2021-30813
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.0.1. A person with access to a host Mac may be able to bypass the Login Window in Remote Desktop for a locked instance of macOS...
CVE-2021-30813
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.0.1. A person with access to a host Mac may be able to bypass the Login Window in Remote Desktop for a locked instance of macOS...
Apple macOS 权限许可和访问控制问题漏洞
Apple macOS is a suite of specialized operating systems from Apple Inc. developed specifically for Mac computers. A privilege-granting and access-control issue vulnerability previously existed in Apple macOS Monterey 12.0.1, which arose from the possibility that someone with access to the host Ma...
UserManager: updateLockedData() doesn't check that the amount is actually locked.
Handle itsmeSTYJ Vulnerability details Impact The function updateLockedData does not actually check if the amount required to be locked is actually locked. Proof of Concept Same solution as my other high issue. I've added comments where relevant. function updateLockedData address borrower, uint25...
Wrong implementation of CreditLimitByMedian.sol#getLockedAmount() makes it unable to unlock lockedAmount in CreditLimitByMedian model
Handle WatchPug Vulnerability details function getLockedAmount LockedInfo memory array, address account, uint256 amount, bool isIncrease public pure override returns uint256 if array.length == 0 return 0; uint256 newLockedAmount; if isIncrease ... else for uint256 i = 0; i amount newLockedAmount ...
Wrong implementation of CreditLimitByMedian.sol#getLockedAmount() will lock a much bigger total amount of staked tokens than expected
Handle WatchPug Vulnerability details function getLockedAmount LockedInfo memory array, address account, uint256 amount, bool isIncrease public pure override returns uint256 if array.length == 0 return 0; uint256 newLockedAmount; if isIncrease for uint256 i = 0; i arrayi.lockedAmount...
CVE-2021-41593
Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure...
Apple Pay Can be Abused to Make Contactless Payments From Locked iPhones
Cybersecurity researchers have disclosed an unpatched flaw in Apple Pay that attackers could abuse to make an unauthorized Visa payment with a locked iPhone by taking advantage of the Express Travel mode set up in the device's wallet. "An attacker only needs a stolen, powered on iPhone. The...
Apple Pay with Visa Hacked to Make Payments via Locked iPhones
An attacker who steals a locked iPhone can use a stored Visa card to make contactless payments worth up to thousands of dollars without unlocking the phone, researchers are warning. The problem is due to unpatched vulnerabilities in both the Apple Pay and Visa systems, according to an academic te...
