12021 matches found
function 'accrueInterest(address vToken)' allows too many rewards to be allocated
Lines of code Vulnerability details Impact Malicious users can increase the number of rewards they receive within a block. Proof of Concept In the Prime contract, marketsvToken.rewardIndex is used to determine how many rewards are allocated to Prime token holders, and its value can only be change...
Electrolink FM/DAB/TV Transmitter (controlloLogin.js) Credential Disclosure
Electrolink FM/DAB/TV Transmitter controlloLogin.js Credentials Disclosure Vendor: Electrolink s.r.l. Product web page: https://www.electrolink.com Affected version: 10W, 100W, 250W, Compact DAB Transmitter 500W, 1kW, 2kW Medium DAB Transmitter 2.5kW, 3kW, 4kW, 5kW High Power DAB Transmitter 100W...
OSV-2023-936 Heap-buffer-overflow in Gfx::decode_bmp_pixel_data
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62782 Crash type: Heap-buffer-overflow READ 1 Crash state: Gfx::decodebmppixeldata Gfx::BMPImageDecoderPlugin::frame Gfx::ICOImageDecoderPlugin::loadicobitmap...
Amazon Linux 2 : python38 (ALASPYTHON3.8-2023-010)
The version of python38 installed on the remote host is prior to 3.8.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PYTHON3.8-2023-010 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It...
Threat Report: High Tech Industry targeted the most with 46% of attack traffic tagged by NLX
How To Use This Report Enhance situational awareness of techniques used by threat actors Identify potential attacks targeting your industry Gain insights to help improve and accelerate your organization's threat response Summary of Findings The Network Effect Threat Report offers insights based o...
GHSA-7MP6-929P-PQHJ vulnerabilities
Vulnerabilities for packages: croc...
Inside XWorm: Malware Analysts Decode the Stealthy Tactics of the Latest Variant
XWorm is a relatively new representative of the remote access trojan cohort that has already earned its spot among the most persistent threats across the globe. Since 2022, when it was first observed by researchers, it has undergone a number of major updates that have significantly enhanced its...
File Manager Pro < 1.8.1 - Admin+ Remote Code Execution
Description The plugin allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution. As an admin, use the File Manager UI to upload a file shell.php...
OSV-2023-862 Heap-use-after-free in g_datalist_get_flags
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62381 Crash type: Heap-use-after-free READ 8 Crash state: gdatalistgetflags gobjectunref gstobjectunref...
Microsoft Exchange Server Information Disclosure Vulnerability (CNVD-2023-72229)
Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. An information disclosure vulnerability exists in Microsoft Exchange Server, which can be exploit...
CVE-2013-5250
Rejected reason: This candidate is unused by its CNA...
CVE-2011-3433
Rejected reason: This candidate is unused by its CNA...
Siemens RUGGEDCOM ROX Improper Neutralization of Special Elements Used in a Command (CVE-2023-36751)
A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.0, RUGGEDCOM ROX MX5000RE All versions V2.16.0, RUGGEDCOM ROX RX1400 All versions V2.16.0, RUGGEDCOM ROX RX1500 All versions V2.16.0, RUGGEDCOM ROX RX1501 All versions V2.16.0, RUGGEDCOM ROX RX1510 All versions V2.16.0...
GHSA-H7CM-MRVQ-WCFR Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration
Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. The current implementation of BaseUser.login leaks enough information to a malicio...
MAL-2023-8358 Malicious code in aws-consoler2 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx b37bd86b6f9bda9d03029c9d2fa09561b2b43cda7c3fddda1389c8e193c4a938 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...
The owner of the PrincipalToken can redeem the asset from escrow before the selected time period expires
Lines of code Vulnerability details Impact After calling the create function, the owner of the DelegateToken gains delegate rights for the duration of the escrow. The documentation for the competition states: "The holder of the PrincipalToken will have the right to redeem the boredom ape from...
LG Simple Editor Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'LG Simple Editor Remote Code Execution', 'Description' = %q This Metasploit module exploits broken access control and directory traversal...
WEBIGniter 28.7.23 Shell Upload
Title: WEBIGniter-28.7.23 File Upload - RCE Author: nu11secur1ty Date: 09/04/2023 Vendor: https://webigniter.net/ Software: https://webigniter.net/demo Reference: https://portswigger.net/web-security/file-upload Description: The media function suffers from file upload vulnerability. The attacker...
This Week in Spring - September 5th, 2023
Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? I just got back from another fabulous labor day weekend, and am headed to Oslo, Norway, for the fabulous JavaZone 2023 event. This will be my first time returning to lovely Oslo, Norway, since the pandemic! I can...