gartenbau-rath.de Cross Site Scripting vulnerability OBB-2688728

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-26477

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

removeAddress doesn't decrease the contracts.length

Lines of code Vulnerability details Impact The contracts length will always increase because the removeAddress function just deleting the value inside the array and never decrease the length by calling pop method. This can lead to Dos when calling functions that doing loop on contracts storage:...

_getTwav is not correct. It is not considering all last 4 blocks.

Lines of code Vulnerability details Impact This will result in invalid deadline to decide the buyout end. Proof of Concept /// @notice returns the TWAV of the last 4 blocks /// @return twav TWAV of the last 4 blocks function getTwav internal view returnsuint256 twav if...

Catly-Translate security vulnerabilities

Catly-Translate is the easy-to-use Baidu translation method. A security vulnerability exists in Catly-Translate. An attacker exploited the vulnerability to access sensitive user information and digital currency keys, as well as elevated privileges...

javaparser:parseFuzzer: Uncaught exception in com.github.javaparser.GeneratedJavaParser.Expression

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=6093728789430272 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

CSRF vulnerability and missing permission checks in beaker-builder

beaker-builder 1.10 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additionally, this form validation method does not require POST requests, resulting in a...

DFSCoerce, a new NTLM relay attack, can take control over a Windows domain

A researcher has published a Proof-of-Concept PoC for an NTLM relay attack dubbed DFSCoerce. The method leverages the Distributed File System: Namespace Management Protocol MS-DFSNM to seize control of a Windows domain. Active Directory A directory service is a hierarchical arrangement of objects...

SpEL Injection Attacks

spring-data-mongodb is vulnerable to Spring Expression Language SpEL injection. The vulnerability exists due to the non-sanitized input in the repository query method, allowing an attacker to inject and execute malicious SpEL to the repository query method when it is annotated with @Query or...

Malicious code in public-method-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56b29a42144105852972b71aeec148bf0858f37aab6727068d76a4ac0c92cf91 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5237 Malicious code in payment_method (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcaf8d7ef9b2e7d4df92b29894c629acbc28978ee0fc89ae8d1b8ce4f45268d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in payment_method (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcaf8d7ef9b2e7d4df92b29894c629acbc28978ee0fc89ae8d1b8ce4f45268d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Did Not Approve To Zero First Causing Certain Token Transfer To Fail

Lines of code Vulnerability details Proof-of-Concept Some tokens like USDT do not work when changing the allowance from an existing non-zero allowance value. For example Tether USDT's approve function will revert if the current approval is not zero, to protect against front-running changes of...

`array!` macro is unsound in presence of traits that implement methods it calls internally

Affected versions of this crate called some methods using auto-ref. The affected code looked like this. rust let mut arr = $crate::core::mem::MaybeUninit::uninit; let mut vec = $crate::ArrayVec::::newarr.asmutptr as mut T; In this case, the problem is that asmutptr is a method of &mut MaybeUninit...

CVE-2022-1833

A flaw was found in AMQ Broker Operator, installed via UI using the OperatorHub. In this vulnerability, a low-privilege user with access to the Operator deployed namespace has access to cluster-wide edit rights. This flaw allows an attacker to have full cluster management access. Mitigation In...

CVE-2022-32550

An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password service. In specific circumstances, this issue allowed a malicious server to convince a 1Password app or integration it is communicating with th...

CVE-2022-32550

An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password service. In specific circumstances, this issue allowed a malicious server to convince a 1Password app or integration it is communicating with th...

PT-2022-14401 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a missing permission check in the onbind method of ShannonRcsService.java. This could lead to local information disclosure without requiring additional execution privileges. User interaction...

Flexible Shipping < 4.11.9 - Reflected Cross-Site Scripting

The plugin does not escape shipping method URLs before outputting them back in an attribute, leading to Reflected Cross-Site Scripting...

Real Player 16.0.3.51 - 'external::Import()' Directory Traversal to Remote Code Execution (RCE)

Exploit Title: Real Player 16.0.3.51 - 'external::Import' Directory Traversal to Remote Code Execution RCE Google Dork: n/a Date: May 31, 2022 Exploit Author: Eduardo Braun Prado Vendor Homepage: http://real.com/ Software Link: http://real.com/ Version: ver. 16.00.282, 16.0.3.51, Cloud 17.0.9.17,...