[ZZ-004] During the deprecation period where both .eth registrar controllers are active, a crafted hack can be launched and cause the same malicious consequences of [ZZ-001] even if [ZZ-001] is properly fixed

Severity: High Status: Has not been reported Description, Specifically, according to the documentation, there will be a deprecation period that two types of .eth registrar controllers are active. Names can be registered as normal using the current .eth registrar controller. However, the new .eth...

MTN Group: Authentication bypass in https://nin.mtn.ng

Summary: In a nutshell, an authentication bypass exploits weak authentication mechanisms to allow a hacker to access your systems and data.In a nutshell, an authentication bypass exploits weak authentication mechanisms to allow a hacker to access your systems and data Steps To Reproduce: 1.I was...

Hurricane-Related Scams 

CISA warns users to remain on alert for malicious cyber activity targeting potential disaster victims and charitable donors following a hurricane. Fraudulent emails—often containing malicious links or attachments—are common after major natural disasters. Exercise caution in handling emails with...

AttachMe – Oracle Patches “Severe” Vulnerability in its Cloud Infrastructure

By Deeba Ahmed Dubbed AttachMe by researchers; the vulnerability was a severe one since it targeted all OIC customers. This is a post from HackRead.com Read the original post: AttachMe - Oracle Patches "Severe" Vulnerability in its Cloud Infrastructure...

Microsoft Discover Severe 'One-Click' Exploit for TikTok Android App

Microsoft on Wednesday disclosed details of a now-patched "high severity vulnerability" in the TikTok app for Android that could let attackers take over accounts when victims clicked on a malicious link. "Attackers could have leveraged the vulnerability to hijack an account without users' awarene...

MAL-2022-6757 Malicious code in ui-shop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1502a52ae156bfc3c6970836d113ad8acd802d037fd01ab787c85d5de0acce0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-153 Malicious code in @btransport/razzle-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32cdc3887e4b95d4b448778312291d04c4242315fcb0b077f7aadd1fc48dea6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1920 Malicious code in clever-goals-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99ef7811241a80a34b41104fa6b735b5fba548a07d98a391da3d4aac2e1203fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5394 Malicious code in pokemon-go-generator-2022-new-pogo-coins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a785ef6645bbbb4c34a3a0a48f2c0f09e8e8850fb490fcd2050c097552e6e87a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6880 Malicious code in ux-tread-crc-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 432450703069dc92f37370ab884a44d4934decfae46baa2d56f140b65cef9d12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-210 Malicious code in @dropcontact/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5c373e0739e7760a1b826371b15f768ea8cd40dcd6bb27579d441ea9e73fdcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Chicago students lose data to ransomware attackers

Chicago Public Schools CPS disclosed on Friday that students may have had their data taken in a ransomware incident involving one of its vendors. The ransomware attack happened last December at Battelle for Kids BfK, based in Columbus Ohio, which develops services to provide innovation in schools...

new packages: pyatspi

An update is available for pyatspi. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterprise...

GHSA-VPGW-FFH3-648H Prototype Pollution in fullpage.js

fullPage utils are available to developers using window.fputils. They can use these utils for their own use-case other than fullPage as well. However, one of the utils deepExtend is vulnerable to Prototype Pollution vulnerability. Javascript is "prototype" language which means when a new "object"...

SAP Patches Severe ‘ICMAD’ Bugs

There’s a trio of critical vulnerabilities, fixed on Tuesday, in SAP business applications that use the ubiquitous Internet Communication Manager ICM: the component that gives SAP products the HTTPS web server they need to connect to the internet or talk to each other. The vulnerabilities,...

[WP-H2] Funds can be frozen when critical key holders lose access to their keys

Lines of code Vulnerability details The current implementation requires trusted key holders Owner to send transactions finalize to finalize the sale before the buyers can claim the tokenOut from the contract. function finalize external onlyOwner require!finalized, "TokenSale: already finalized";...

Griefing attack can prevent almost all activity in a pool

Handle harleythedog Vulnerability details Impact Consider the mint function in TimeswapPair.sol. The caller of this function is able to freely specify xIncrease, yIncrease and zIncrease. In particular, it is possible to specify xIncrease and zIncrease to be extremely small values e.g. 1 wei, whil...

Vulnerability Research Highlights 2021

At SonarSource we are constantly improving our code analyzers to help developers write Clean Code. The detection of severe code vulnerabilities plays an important role in this process so that applications are protected from attacks and security breaches. For this same reason, our research team...

CVE-2021-43545

Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

_transferBurn does not actually burn tokens (decrease supply)

Handle harleythedog Vulnerability details Impact The implementation of transferBurn in ovl/OverlayToken.sol does not actually burn any tokens since totalSupply is not decreased see the implementation for burn for reference of what should be done. The transferBurn function is a helper function tha...