EVM Elliptic Curve Recovery Discrepancy

Lines of code Vulnerability details Impact The Ecrecover.yul file meant to simulate the ecrecover mechanism as executed by traditional ETH 1.0 consensus mechanisms is incorrect. In detail, it does not conform to the "Homestead" update which introduced an upper-bound check for s values of an r, s,...

OpenSSH 安全漏洞

OpenSSH OpenBSD Secure Shell is a set of connection tools for secure access to remote computers from the Canadian OpenBSD Project Group. The tools are an open source implementation of the SSH protocol and support encryption of all transmissions, effectively blocking eavesdropping, connection...

BYTES2.getReward: no check for input

Lines of code Vulnerability details Impact the function getReward should validate that to is not an empty address 0x0 to prevent accidental loss of BYTES. Impact: mint reward BYTES to address0 will be lost Proof of Concept function getReward address to external uint256 reward, uint256 daoCommisio...

WordPress Smart Slider 3 Plugin < 3.5.1.11 Object Injection Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nextendweb:smartslider3"; if description...

CVE-2023-1370

The CVE-2023-1370 entry concerns Netplex Json-smart, a JSON processing library. Public materials in the connected docs confirm a stack-exhaustion (DoS) due to unbounded nesting when parsing nested arrays/objects in JSON input, caused by recursive parsing. Affected version range is 2.5.0 through 2...

CVE-2023-1370

Json-smart is a performance focused, JSON processor lib. When reaching a ‘‘ or ‘‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays a...

CVE-2023-1370 Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

Json-smart is a performance focused, JSON processor lib. When reaching a ‘‘ or ‘‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays a...

CVE-2023-1370 Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

Json-smart is a performance focused, JSON processor lib. When reaching a ‘‘ or ‘‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays a...

Researchers Uncover Over a Dozen Security Flaws in Akuvox E11 Smart Intercom

More than a dozen security flaws have been disclosed in E11, a smart intercom product made by Chinese company Akuvox. "The vulnerabilities could allow attackers to execute code remotely in order to activate and control the device's camera and microphone, steal video and images, or gain a network...

PT-2023-4904 · Unknown +4 · Json Smart +5

Name of the Vulnerable Software and Affected Versions: Json-smart versions 2.5.0 through 2.5.1 Description: The issue is related to uncontrolled recursion in the Json-smart library. When the library encounters a '' or '' character in the JSON input, it parses an object or array respectively...

Everything wrong with deposit method

Lines of code Vulnerability details Impact No Accounting, Wrong data in Event emission in case of Fees on transfer Tokens and limited usecase. Proof of Concept File: DAO.sol function deposit address token, uint256 amount, string calldata reference external payable override if amount == 0 revert...

Debian: Security Advisory (DSA-1734-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

LQTYStaking.sol – Reentrancy risk in stake() unstake() functions

Lines of code Vulnerability details In the LQTY smart contract, the stake and unstake functions are used to add or remove a certain amount of LQTY tokens from a user's stake, respectively. Both functions are designed to update the user's stake and the total amount of LQTY staked while allowing...

WordPress Smart Slider 3 Plugin < 3.5.1.14 is vulnerable to Cross Site Scripting (XSS)

Software Smart Slider 3 Type Plugin Vulnerable versions 3.5.1.14 Fixed in 3.5.1.14 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0660 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 008134aaa2eb Credits Erwan LR WPScan...

@aragon/core-contracts (>=0.7.0-alpha, <=0.8.0-alpha), @aragon/osx (>=1.2.0, <=1.3.0) +42 more potentially affected by CVE-2023-26488 via @openzeppelin/contracts-upgradeable (>=4.8.0, <=4.8.1)

@openzeppelin/contracts-upgradeable NPM version =4.8.0, =0.7.0-alpha, =1.2.0, =0.0.1, =0.0.1, =0.0.1, =1.0.4, =2.0.0, =1.0.1, =1.0.15, =1.0.27, =1.0.16, =1.0.29 and more Source cves: CVE-2023-26488 Source advisory: OSV:GHSA-878M-3G6Q-594Q...

@1inch/delegating (>=0.0.8, <=0.0.21), @1inch/erc20-pods (>=0.0.8, <=0.0.17) +67 more potentially affected by CVE-2023-26488 via @openzeppelin/contracts (>=4.8.0, <=4.8.1)

@openzeppelin/contracts NPM version =4.8.0, =0.0.8, =0.0.8, =1.1.2, =0.0.1, =2.0.0, =0.7.0-alpha, =1.2.0, =0.0.1, =1.0.4, =1.0.1, =1.0.15, =2.0.2 and more Source cves: CVE-2023-26488 Source advisory: OSV:GHSA-878M-3G6Q-594Q...

WordPress Smart Logo Showcase Lite Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)

Software Smart Logo Showcase Lite Type Plugin Vulnerable versions = 1.1.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0175 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 946d9d91d290 Credits Lana Codes...

Huawei Children Smart Watch (Simba-AL00) Access Control Error Vulnerability

The Huawei Children Smart Watch is a children's watch from the Chinese company Huawei Huawei. The Huawei Children Smart Watch Simba-AL00 suffers from an Access Control Error vulnerability that can be exploited by an attacker to cause an application-specific access control to fail...

workspace cannot find a valid smart card certificate

Workspace App gives error " cannot find a valid smart card certificate". This works via Browser but not via Workspace App...

Could Bitcoin Be The Future Of DeFi?

By Waqas Bitcoin has both security and liquidity, and now, with the addition of smart contract capabilities, it has all the ingredients required for DeFi to take off. This is a post from HackRead.com Read the original post: Could Bitcoin Be The Future Of DeFi?...