CVE-2022-3316

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass security feature via a crafted HTML page. Chromium security severity: Low...

phpCAS vulnerable to Service Hostname Discovery Exploitation

phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...

CVE-2022-3316

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass security feature via a crafted HTML page. Chromium security severity: Low...

CVE-2022-3316

CVE-2022-3316 describes an Insufficient validation of untrusted input in Safe Browsing in Google Chrome (Chromium) prior to 106.0.5249.62. The vulnerability allows a remote attacker to bypass a security feature via a crafted HTML page, with network attack vector, low severity, and a medium base C...

openSUSE 15 Security Update : opera (openSUSE-SU-2022:10181-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10181-1 advisory. - Use after free in Skia. CVE-2022-3445 - Heap buffer overflow in WebSQL. CVE-2022-3446 - Inappropriate implementation in Custom Tabs...

openSUSE 15 Security Update : opera (openSUSE-SU-2022:10182-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10182-1 advisory. - Use after free in Skia. CVE-2022-3445 - Heap buffer overflow in WebSQL. CVE-2022-3446 - Inappropriate implementation in Custom Tabs...

CVE-2022-3316: Undefined Security Weakness

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass security feature via a crafted HTML page. Chromium security severity: Low...

CVE-2022-3316

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass security feature via a crafted HTML page. Chromium security severity: Low...

CVE-2022-3316

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass security feature via a crafted HTML page. Chromium security severity: Low...

GLSA-202210-16 : Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202210-16 Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities - Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to...

MAL-2022-5906 Malicious code in safe-nonce-7218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e864553aef6b02164be2545e5e92bc8443d5eea8820f88a44a30f84a773c8e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5905 Malicious code in safe-nonce-6218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b26fc284064f9aad0b6e5f8e05c9ee3c7d9642783b8431ac1e90a4bcdfc869a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in safe-nonce-7218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e864553aef6b02164be2545e5e92bc8443d5eea8820f88a44a30f84a773c8e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in safe-nonce-6218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b26fc284064f9aad0b6e5f8e05c9ee3c7d9642783b8431ac1e90a4bcdfc869a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Transfering funds to yourself increases your balance

Lines of code Vulnerability details Impact Using temporary variables to update balances is a dangerous construction that has led to several hacks in the past. Here, we can see that toBalance can overwrite fromBalance: File: LBToken.sol 176: function transfer 177: address from, 178: address to, 17...

Unsafe downcast operations can lead to silent failures

Lines of code Vulnerability details Solidity won't perform automatic checks when downcasting and it's possible for some fields to overflow while adding tiers. Proof of Concept Assume that in JBTiered721DelegateStore.recordAddTiers, one item for tiersToAdd contains votingUnits bigger than the size...

Upgraded Q -> M from 696 [1666361742731]

Judge has assessed an item in Issue 696 as Medium risk. The relevant finding follows: L05 - Usage of trasfer over call to send Ether could cause unexpected Reverts payablepayAddress.transferpayAmt; // royalty transfer to royaltyaddress The function payEther sends ether via transfer which passes a...

Malicious code in redirect-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2723505363a2e79b392ee0106e75b8f0a465536eb6b622c6f689123ea2d4a3bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5721 Malicious code in redirect-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2723505363a2e79b392ee0106e75b8f0a465536eb6b622c6f689123ea2d4a3bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CSRF protection for any URL can be bypassed in pipeline-input-step

pipeline-input-step 451.vf1aa4f405289 and earlier does not restrict or sanitize the optionally specified ID of the input step. This ID is used for the URLs that process user interactions for the given input step proceed or abort and is not correctly encoded. This allows attackers able to configur...