Huawei HarmonyOS Denial of Service Vulnerability (CNVD-2022-04710)

Huawei HarmonyOS is an operating system from Huawei China. It provides a microkernel-based distributed operating system. Huawei HarmonyOS Vision is a security vulnerability in some Huawei Smart Screens. An attacker could exploit the vulnerability to cause a WLAN denial of service...

vulnerability

Handle 0v3rf10w Vulnerability details In technical terms, Timeswap is an automated protocol based on the use of liquidity pools and implemented on the Ethereum blockchain. Users create liquidity pools with the participation of smart contracts. One pool is one marketplace providing exchange in a...

Iterating over large count numbers can cause out of gas errors

Handle jayjonah8 Vulnerability details Impact In XDEFIDistributionHelper.sol the getAllTokensForAccount function iterates over the count and performs actions on each iteration. Iterating over large arrays can cause out of gas failures and so the count number should be checked or limited to a max...

SAILFISH System to Find State-Inconsistency Bugs in Smart Contracts

A group of academics from the University of California, Santa Barbara, has demonstrated what it calls a "scalable technique" to vet smart contracts and mitigate state-inconsistency bugs, discovering 47 zero-day vulnerabilities on the Ethereum blockchain in the process. Smart contracts are program...

WordPress Buttonizer-Smart Floating Action Button plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. buttonizer-Smart Floating Action Button plugin has a cross-site scripting vulnerability in versions prior to 2.5.5,...

CVE-2021-24992

The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24992

The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24992

The CVE-2021-24992 issue affects the WordPress Buttonizer (Smart Floating / Sticky Buttons) plugin for WordPress, prior to version 2.5.5. The root cause is failure to sanitise and escape certain parameters before outputting them in HTML attributes and pages, enabling stored Cross-Site Scripting b...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the Smart...

Huawei HarmonyOS Input Validation Error Vulnerability (CNVD-2022-01676)

Huawei HarmonyOS is an operating system from Huawei China Inc. A vulnerability exists in the Huawei HarmonyOS component due to an input validation error. The vulnerability stems from a network system or product that does not properly validate input data, and can be exploited by an attacker to...

mintSynth and mintFungible function are not verified from==msg.sender

Handle cccz Vulnerability details Impact The mintSynth function and the mintFungible function are not verified from==msg.sender, causing anyone to use other people’s tokens to mint Synth or LP tokens for themselves Proof of Concept Tools Used Manual analysis Recommended Mitigation Steps Add the...

MUI - A GUI Plugin For Binary Ninja To Easily Interact With And View The Progress Of Manticore

With the Manticore User Interface MUI project, we provide a graphical user interface plugin for Binary Ninja to allow users to easily interact with and view progress of the Manticore symbolic execution engine for analysis of smart contracts and native binaries. ATTENTION This project is under...

Smart SEO Tool < 3.0.6 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting With the "TDK optimization" setting enabled 7th page, first one: https://example.com/?s=123456"alert/XSS...

Out of gas.

Handle Jujic Vulnerability details There is no upper limit on poolColl.tokens, it increments each time when a new collateral is added. Eventually, as the count of collateral increases, gas cost of smart contract calls will raise and that there is no implemented function to reduce the array size...

WordPress Smart Coupons for WooCommerce plugin <= 1.3.5 - Authenticated SQL injection (SQLi) vulnerability

Authenticated SQL injection SQLi vulnerability discovered in WordPress Smart Coupons for WooCommerce plugin versions = 1.3.5. Solution Update the WordPress Smart Coupons for WooCommerce plugin to the latest available version at least 1.3.6...

The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.

...

The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.

...

json-smart: uncaught exception may lead to crash or information disclosure

A flaw was found in json-smart. When an exception is thrown from a function, but is not caught, the program using the library may crash or expose sensitive information. The highest threat from this vulnerability is to data confidentiality and system availability. In OpenShift Container Platform...

Critical: Red Hat Security Advisory: Red Hat Fuse 7.10.0 release and security update

A minor version update from 7.9 to 7.10 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring...

PT-2021-7782 · Schneider Electric · Evlink City +2

Name of the Vulnerable Software and Affected Versions: EVlink City versions prior to R8 V3.4.0.2 EVlink Parking versions prior to R8 V3.4.0.2 EVlink Smart Wallbox versions prior to R8 V3.4.0.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This vulnerability...