Upgraded Q -> 2 from #42 [1684786437801]

Judge has assessed an item in Issue 42 as 2 risk. The relevant finding follows: While the "division before multiplication" issues described in M-01 have been mitigated in the proposed changeset, there are other cases which should be addressed too. Technical Details In SafEth::stake the calculatio...

Vulnerability of EVlink City’s parking charging station software. EVlink Parking and EVlink Smart Wallbox are vulnerable due to the lack of measures taken to protect the website structure, allowing attackers to impersonate users who control the charging stations.

Vulnerability of EVlink City parking charging stations’ software. The existence of EVlink Parking and EVlink Smart Wallbox stems from the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to impersonate a user controlling the...

Vulnerability of EVlink City parking charging station software. EVlink Parking and EVlink Smart Wallbox, which allow violators to gain unauthorized access to the charging station’s web server.

Vulnerability of EVlink City parking charging station software. EVlink Parking and EVlink Smart Wallbox are associated with insufficient entropy. Exploiting this vulnerability could allow an unauthorized attacker to gain unauthorized access to the charging station’s web server...

Vulnerability of EVlink City parking charging station software. EVlink Parking and EVlink Smart Wallbox, which rely on rigidly encoded credentials, allow intruders to obtain unauthorized administrative privileges.

Vulnerability of EVlink City parking charging station software. EVlink Parking and EVlink Smart Wallbox utilize strict encoding for user data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized administrative privileges...

WordPress Smart App Banner Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Smart App Banner Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-33315 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 1486e25e9154 Credits Yuki Haruma Requir...

Smart App Banner < 1.1.2 - Cross-Site Request Forgery (CSRF)

The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in user to submit a crafted request...

Default credentials

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This applies to contracts compiled with vyper version...

CVE-2023-32675

CVE-2023-32675 affects Vyper prior to 0.3.8. In contracts with more than one regular nonpayable function, funds could be sent to the default function even if it is nonpayable due to an early calldatasize check, as described in public advisories. The issue was fixed by removing the global calldata...

CVE-2023-32675 Nonpayable default functions are sometimes payable in vyper

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This applies to contracts compiled with vyper version...

CVE-2023-32675 Nonpayable default functions are sometimes payable in vyper

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This applies to contracts compiled with vyper version...

CVE-2023-32675 Nonpayable default functions are sometimes payable in vyper

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This applies to contracts compiled with vyper version...

K000134680: JSON Smart vulnerability CVE-2021-31684

Security Advisory Description A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service DOS via a crafted web request. CVE-2021-31684 Impact There is no impact; F5 products are not affected by this...

This Cybercrime Syndicate Pre-Infected Over 8.9 Million Android Phones Worldwide

A cybercrime enterprise known as Lemon Group is leveraging millions of pre-infected Android smartphones worldwide to carry out their malicious operations, posing significant supply chain risks. "The infection turns these devices into mobile proxies, tools for stealing and selling SMS messages,...

Important: Red Hat Security Advisory: Red Hat AMQ Streams 2.4.0 release and security update

Red Hat AMQ Streams 2.4.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Qrio Smart Lock Q-SL2 vulnerable to authentication bypass by capture-replay

Overview Qrio Smart Lock Q-SL2 provided by Qrio, inc. contains an authentication bypass by capture-replay vulnerability CWE-294. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

New Strain of Sotdas Malware Discovered

Introduction There are numerous malicious codes that are currently active on smart devices, such as Ddosf, Dofloo, Gafgyt, MrBlack, Persirai, Sotdas, Tsunami, Triddy, Mirai, Moose, and Satori, among others. These malicious codes and their variants can intrude into and control smart devices throug...

CVE-2023-27217

A stack-based buffer overflow in the ChangeFriendlyName function of Belkin Smart Outlet V2 F7c063 firmware2.00.11420.OWRT.PVTSNSV2 allows attackers to cause a Denial of Service DoS via a crafted UPNP request...

CVE-2023-27217

A stack-based buffer overflow in the ChangeFriendlyName function of Belkin Smart Outlet V2 F7c063 firmware2.00.11420.OWRT.PVTSNSV2 allows attackers to cause a Denial of Service DoS via a crafted UPNP request...

CVE-2023-27217

A stack-based buffer overflow in the ChangeFriendlyName function of Belkin Smart Outlet V2 F7c063 firmware2.00.11420.OWRT.PVTSNSV2 allows attackers to cause a Denial of Service DoS via a crafted UPNP request...

CVE-2023-20110

A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface inadequately validat...