Cannot unfollow a profile without having access to the Follow NFT

Lines of code Vulnerability details Impact In scenarios where a user fails to unfollow a profile before selling his follow NFT, he could forever be unable to unfollow the profile. Proof of Concept A user could sell his follow NFT without unfollowing a profile. If the new owner of the follow NFT...

Missing owner check on from when transferring tokens

Lines of code Vulnerability details Impact The LensBaseERC721.transferFrom/safeTransferFrom/burn they check approvals on msg.sender through isApprovedOrOwnermsg.sender, tokenId, it is never checked that the specified from parameter is actually the owner of the NFT. An attacker can decrease other...

If a lower multiplier for a particular NFT was set the owner of this NFT can avoid syncing votes with new values.

Lines of code Vulnerability details Impact The current situation presents an issue as it is impossible to identify the addresses of users who possess specific NFT tokens locked in the contract. Consequently, if a new multiplier is lower than the previous one, a "malicious" user could exploit this...

USN-6260-1: Linux kernel vulnerabilities

It was discovered that the NTFS file system implementation in the Linux kernel did not properly check buffer indexes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to expose sensitive information kernel memory. CVE-2022-48502...

Virtuozzo Hybrid Server 7.5 Update 5 (7.5.5-249)

Virtuozzo Hybrid Server 7.5 Update 5 introduces new features and provides stability and usability bug fixes. Additionally, it provides a new kernel 3.10.0-1160.90.1.vz7.200.7. Vulnerability id: PSBM-148279 Live migration of Windows 2008 Server R2 virtual machines between Virtuozzo Hybrid Server 7...

PT-2023-4318 · Linux +6 · Linux Kernel +6

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free vulnerability in the Linux kernel's netfilter: nf tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule,...

USN-6247-1 linux-oem-5.17 vulnerabilities

David Leadbeater discovered that the netfilter IRC protocol tracking implementation in the Linux Kernel incorrectly handled certain message payloads in some situations. A remote attacker could possibly use this to cause a denial of service or bypass firewall filtering. CVE-2022-2663 It was...

USN-6246-1 linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi vulnerabilities

It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-3090...

LSN-0096-1: Kernel Live Patch Security Notice

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service system crash ...

The vulnerability of the nft_immediateDestroy() function in the net/netfilter/nft_immediate.c module of the Netfilter subsystem in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of the nftimmediateDestroy function in the net/netfilter/nftimmediate.c module of the Netfilter subsystem in the Linux operating system is related to incorrect handling of usage counters. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

The vulnerability of the nft_chain_lookup_byid() function in the net/netfilter/nf_tables_api.c module of the Linux kernel’s netfilter packet filtering subsystem allows a attacker to escalate their privileges and compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nftchainlookupbyid function in the net/netfilter/nftablesapi.c module of the Linux kernel’s packet filtering subsystem is related to the reutilization of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an attacker t...

PT-2023-4154 · Linux +10 · Linux Kernel +10

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free flaw was found in the Linux kernel's netfilter, specifically in the way a user triggers the nft pipapo remove function with the element, without a NFT SET EXT KEY END...

The vulnerability of the nft_byteorder_eval() function in the net/netfilter/nft_byteorder.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nftbyteordereval function in the net/netfilter/nftbyteorder.c module of the Linux operating system is related to the issue of data being written outside of the buffer during pointer handling. Exploiting this vulnerability could allow an attacker to compromise the...

DEBIAN-CVE-2023-31248

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; nftchainlookupbyid failed to check whether a chain was active and CAPNETADMIN is in any user or network namespace...

M2E Platform Sweat Economy Launches Flagship NFT Game: Sweat Hero

By Owais Sultan Sweat Hero becomes the first ever NFT game within a move-to-earn platform. This is a post from HackRead.com Read the original post: M2E Platform Sweat Economy Launches Flagship NFT Game: Sweat Hero...

PT-2023-3559 · Linux +10 · Linux Kernel +10

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to 5.19.0-35 Description: The issue is related to the nft byteorder function in the Linux Kernel's netfilter subsystem, which poorly handles vm register contents when CAP NET ADMIN is in any user or network...

CVE-2023-3249

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hiddenformdata' function. This makes it possible for authenticated attackers to log in as...

Authentication flaw

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hiddenformdata' function. This makes it possible for authenticated attackers to log in as...

CVE-2023-3249

The WordPress plugin Web3 – Crypto wallet Login & NFT token gating (Web3 authentication) is affected by CVE-2023-3249. Affected versions up to and including 2.6.0 suffer an authentication bypass due to an incorrect check in the hidden_form_data routine, allowing an authenticated attacker to log i...

CVE-2023-3249

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hiddenformdata' function. This makes it possible for authenticated attackers to log in as...