Initialization function can be front-run

Lines of code Vulnerability details Detailed description of the impact of this finding: Exchange.sol has initialization function that can be front-run, allowing an attacker to incorrectly initialize the contract. Due to the use of the delegatecall proxy pattern, Exchange.sol cannot be initialized...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Nov 2022)

This host is missing a critical security update according to Microsoft Office Click-to-Run update November 2022 SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2022-40284

...

CVE-2022-41205

SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which can cause a limited impact on confidentiality and high impact on availability of the application...

Hacker can front-run the L2 ERC20 token deployment.

Lines of code Vulnerability details Impact hacker can front-run the L2 ERC20 token deployment to block L2 ERC20 token finalizeDeposit Proof of Concept I intend to prove this piece of code is front-runnable by hacker: /// @notice Finalize the deposit and mint funds /// @param l1Sender The account...

November 1, 2022, update for Office 2016 (KB5002306)

None None...

Front-running approve function

Lines of code Vulnerability details Description There is approve function in a DolaBorrowingRights. Let's say that Alice wants to increase the approval for Bob from 10 to 20. Alice calls the approve or permit function. Then, Bob can front-run the transaction by spending the 10 tokens and getting...

run-terraform allows for RCE via terraform plan

Impact What kind of vulnerability is it? Who is impacted? All users of the run-terraform reusable workflow from the kartverket/github-workflows repo are affected. A malicious actor could potentially send a PR with a malicious payload leading to execution of arbitrary JavaScript code in the contex...

Exploit for Code Injection in Apache Commons_Text

CVE-2022-42889-POC A simple demo application that shows how to...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Oct 2022)

This host is missing a critical security update according to Microsoft Office Click-to-Run update October 2022 SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

CVE-2022-37987

Windows Client Server Run-time Subsystem CSRSS Elevation of Privilege Vulnerability...

Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability

...

CVE-2022-37987

CVE-2022-37987 is a Windows CSRSS local privilege-elevation vulnerability in the Client Server Run-time Subsystem. The CVSSv3.1 base score is 7.8 (HIGH) with local attack vector, low attack complexity, and privileges required: LOW; impact to confidentiality, integrity, and availability is HIGH. A...

Siemens LOGO! 8 BM 安全漏洞

Siemens LOGO! 8 BM is a programming software for industrial environments for the Windows platform from Siemens Germany. Siemens LOGO! 8 BM suffers from a buffer overflow vulnerability that stems from an inability to properly validate the structure of a TCP packet through a variety of methods. An...

Iran State-Run TV’s Live Transmission Hacked by Edalate Ali Hackers

By Waqas As seen by Hackread.com, the Iranian broadcaster was hacked while airing a news bulletin on Saturday night. This is a post from HackRead.com Read the original post: Iran State-Run TVs Live Transmission Hacked by Edalate Ali Hackers...

Jenkins plugins Multiple Vulnerabilities (2022-09-21)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins 2.367 through 2.369 both inclusive does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins...

CVE-2022-42457

Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches runupdate in /usr/bin/gxserve-update.sh e.g., command execution can occur via a reverse shell installed by install.sh...

October 4, 2022, update for Office 2013 (KB5002274)

October 4, 2022, update for Office 2013 KB5002274 This article describes update 5002274 for Microsoft Office 2013 that was released on October 4, 2022. This update also applies to Office Home and Student 2013 RT.Be aware that the update in the Microsoft Download Center applies to the Microsoft...

[NAZ-M3] initialize() Can be Front-Run

Lines of code Vulnerability details Impact AlgebraPool.sol is deployed and initialized in two different transactions. This allows an attacker to be able front-run the AlgebraPool.sol's initialize after it's deployed. Proof of Concept The attacker can do this for two different reasons: 1. Price =...

CVE-2022-41233

Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled...