PT-2025-25912 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.4.0-1086-azure 9118.04.1-Ubuntu Description: The issue is related to the storvsc error wq workqueue in the Linux kernel, which was incorrectly marked as WQ MEM RECLAIM. This marking may cause a deadlock while...

PT-2023-20338 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 11.0 and below Description: The issue is a cross-site-request forgery vulnerability that may allow an attacker to trick an authorized user into executing unwanted actions. Recommendations: For Esri Portal for...

Overflow Excessive claims could overwhelm storage _userWithdrawals mapping

Lines of code Vulnerability details Impact By submitting an excessive number of claims through a compromised user, an attacker could theoretically overwhelm the storage used for mapping users to their delayed withdrawals. If critical data is overwritten, the contract would be rendered unusable...

PT-2023-18577 · Alf.Io · Alf.Io

Name of the Vulnerable Software and Affected Versions: alfio-event/alf.io versions prior to 2.0-M4-2304 Description: The issue concerns an improper authorization of an index containing sensitive information. This could potentially allow for an authorization bypass through a user-controlled key...

PT-2023-15309 · Unknown · Daniel Powney Multi Rating

Name of the Vulnerable Software and Affected Versions: Daniel Powney Multi Rating plugin versions = 5.0.5 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting vulnerability. This allows for malicious scripts to be injected into a website, potentially leading to...

Rittal CMC III Access systems

1. EXECUTIVE SUMMARY CVSS v3 4.8 Vendor: Rittal Equipment: CMC III Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to open control cabinets secured with Rittal locks. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Rittal...

Fee on transfer tokens will not behave as expected

Lines of code Vulnerability details Impact In Numoen, it does not specifically restrict the type of ERC20 collateral used for borrowing. If fee on transfer tokens is/are entailed, it will specifically make mint revert in Lendgine.sol when checking if balanceAfter balanceBefore + collateral. Proof...

PT-2023-7914 · Baicells · Baicells Nova 233 +3

Name of the Vulnerable Software and Affected Versions: Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB and Nova 246 devices with firmware through RTS/RTD 3.6.6 Description: The issue exists due to inadequate protection of the web page structure in Baicells LTE network management systems...

Adobe Illustrator out-of-bounds read vulnerability (CNVD-2023-07315)

Adobe Illustrator is a vector-based image creation software from Adobe. Adobe Illustrator has an out-of-bounds read vulnerability that can be exploited by attackers to bypass mitigation measures such as ASLR and cause sensitive memory leaks...

Adobe Illustrator out-of-bounds read vulnerability (CNVD-2023-07316)

Adobe Illustrator is a vector-based image creation software from Adobe. Adobe Illustrator has an out-of-bounds read vulnerability that can be exploited by attackers to bypass mitigation measures such as ASLR and cause sensitive memory leaks...

Proposal can be infinitely DOSed with no additional conditions

Lines of code Vulnerability details Description OptimisticListingSeaport.sol is easily DOSable due to the following conditions: 1. A new proposal overrides the existing proposal 2. The deposited collateral can be any non-zero amount 3. Only requirement is that pricePerToken is lower than before. ...

Draw admin/owner can rug the winner after recoverTimelock expires.

Lines of code Vulnerability details Impact The admin/owner of VRFNFTRandomDraw can wait for recoverTimelock to expire before making the draw. This way he can use lastResortTimelockOwnerClaimNFT to take back the reward NFT from the contract without any time to allow for the winner to claim. He cou...

Hackers Sign Android Malware Apps with Compromised Platform Certificates

Platform certificates used by Android smartphone vendors like Samsung, LG, and MediaTek have been found to be abused to sign malicious apps. The findings were first discovered and reported by Google reverse engineer Łukasz Siewierski on Thursday. "A platform certificate is the application signing...

Seller can stole users assets by create and then cancel the auction

Lines of code Vulnerability details Impact Seller can stole users assets by create and cancel auction Proof of Concept Seller can create an auction, then wait for people to participate in auction bidding, finally the seller cancel the auction and get the users assets. This scenario can happen wit...

PT-2022-37387 · Pypi · D8S-Xml +1

Name of the Vulnerable Software and Affected Versions: d8s-xml version 0.1.0 Description: The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. Recommendations: For version 0.1.0, avo...

Adobe Illustrator out-of-bounds read vulnerability (CNVD-2023-07323)

Adobe Illustrator is a vector-based image creation software from Adobe. Adobe Illustrator has an out-of-bounds read vulnerability that can be exploited by attackers to bypass mitigation measures such as ASLR and cause sensitive memory leaks...

Unused deadline checker modifier may result in user fund loss due to unexpect transaction ordering (MEV)

Lines of code Vulne...

0Day vulnerability discovered in Atlassian Confluence

A 0Day vulnerability has been discovered in Atlassian Confluence Server and Confluence Datacenter. An unauthenticated malicious party can exploit the vulnerability to execute arbitrary code with application privileges and thus also gain access to sensitive data within the scope of the affected...

Repeated calls to deliverBribes() risks draining bribe of assets into Gauge

Lines of code Vulnerability details Impact Funds drain from Bribe prematurely with repeated calls to deliverBribes Proof of Concept Calling deliverBribes calls deliverRewards which transfers the amount specified as the rewards due and sends to gauge. Repeated calls to deliverBribes makes repeated...

Multiple Adobe Products Out-of-Bounds Reading Vulnerabilities (CNVD-2022-43457)

Adobe Acrobat is a set of PDF file editing and conversion tools. Adobe Acrobat Reader is a PDF viewer. The software is used to print, sign and annotate PDFs. several Adobe products have an out-of-bounds read vulnerability, which can be exploited by attackers to bypass mitigation measures such as...