PT-2022-17986 · Zoho · Zoho Manageengine Remote Access Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Remote Access Plus versions prior to 10.1.2137.15 Description: The issue allows guest users to view domain details, including the username and GUID of an administrator. Recommendations: For versions prior to 10.1.2137.15,...

GHSA-2XXX-FHC8-9QVQ Ecto missing `is_nil` requirement

Ecto will not raise on queries with non-explicit nil comparisons ie if they aren't checked with isnil...

Ecto missing `is_nil` requirement

Ecto will not raise on queries with non-explicit nil comparisons ie if they aren't checked with isnil...

CVE-2022-28352

WeeChat aka Wee Enhanced Environment for Chat 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: this only affects...

CVE-2021-23850

A specially crafted TCP/IP packet may cause a camera recovery image telnet interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical access to the camera and allows the upload...

CSRF vulnerability and missing permission checks in proxmox

proxmox 0.7.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to: connect to an attacker-specified host using attacker-specified username and password, performing a connection test, disable SSL/TLS validation for the...

Factual-Rules-Generator - An Open Source Project Which Aims To Generate YARA Rules About Installed Software From A Machine

Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a running operating system. The goal of the software is to be able to use a set of rules against collected or acquired digital forensic evidences and find installed software in a time...

CVE-2022-25514

stbtruetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT at stbtruetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input...

US Critical Infrastructure Companies Will Have to Report When They Are Hacked

This will be law soon: Companies critical to U.S. national interests will now have to report when theyre hacked or they pay ransomware, according to new rules approved by Congress. … The reporting requirement legislation was approved by the House and the Senate on Thursday and is expected to be...

PT-2022-17553 · Samsung · Galaxy Watch Plugin

Name of the Vulnerable Software and Affected Versions: Galaxy Watch Plugin versions prior to 2.2.05.22012751 Description: The issue allows an attacker to access password information of connected WiFiAp in the log. Recommendations: For Galaxy Watch Plugin versions prior to 2.2.05.22012751, update ...

The pay() function can still be DOSed

Lines of code Vulnerability details Impact From the prior contest: in the pay function users repay their debt and in line 364: it decreases their debt. lets say a user wants to repay all his debt, he calls the pay function with his full debt. an attacker can see it and frontrun to repay a single...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requirement bypasses...

IRS To Ditch Biometric Requirement for Online Access

The Internal Revenue Service IRS said today it will be transitioning away from requiring biometric data from taxpayers who wish to access their records at the agencys website. The reversal comes as privacy experts and lawmakers have been pushing the IRS and other federal agencies to find less...

DEBIAN-CVE-2022-23614

Twig is an open source template language for PHP. When in a sandbox mode, the arrow parameter of the sort filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of...

CVE-2021-44451

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher...

flan can't be transferred unless the flan contract has flan balance greater than the amount we want to transfer

Handle CertoraInc Vulnerability details Flan.sol safeTransfer function The flan contract must have balance and must have more flan then we want to transfer in order to allow flan transfers. If it doesn't have any balance, the safeTransfer, which is the only way to transfer flan, will call transfe...

java-1.8.0-openjdk security and bug fix update

1:1.8.0.322.b06-2 - Fix FIPS issues in native code and with initialisation of java.security.Security - Related: rhbz2039366 1:1.8.0.322.b06-1 - Update to aarch64-shenandoah-jdk8u322-b06 EA - Update release notes for 8u322-b06. - Switch to GA mode for final release. - Require tzdata 2021e as of...

CVE-2022-22988

File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authenticated attacker to now traverse through the files and directories. This can only be exploited once an attacker has already found a way to...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the valueOf function which allows to reproduce the last id generated. PoC javascript import nanoid from 'nanoid'; const makeProxyNumberToReproducePreviousID = = let step = 0; return valueOf // // if !pool ||...

CVE-2021-29454 Sandbox Escape by math function in smarty

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the...