CVE-2021-40866

Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the disabled by default /sqfs/bin/sccd daemon, which fails to check authentication when the authentication TLV is missing from a received NSDP packet. This affects GC108P before 1.0.8....

Netgear NETGEAR 竞争条件问题漏洞

Netgear NETGEAR is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in the NETGEAR Smart Switch that stems from the device's multi-step HTTP authentication process only...

Facebook puts on Ray-Bans, struts into the privacy minefield of smart glasses

Facebook, neck-deep in virtual / augmented reality with the Oculus headset, continues to move things up a gear. Its announced “Ray-Ban stories”, smart glasses which take video and photos. The company may yet go one step further and incorporate these features into Augmented Reality AR specs which ...

Use of transfer() instead of call() to send eth

Handle JMukesh Vulnerability details Impact Use of transfer might render ETH impossible to withdraw becuase after istanbul hardfork , there is increases in the gas cost of the SLOAD operation and therefore breaks some existing smart contracts.Those contracts will break because their fallback...

Patch now! Netgear fixes serious smart switch vulnerabilities

In a security advisory, NetGear has announced it has fixed three vulnerabilities in firmware updates for several network devices. Most of the affected products are smart switches, some of them with cloud management capabilities that allow for configuring and monitoring them over the web. One of t...

Critical Auth Bypass Bug Affect NETGEAR Smart Switches — Patch and PoC Released

Networking, storage and security solutions provider Netgear on Friday issued patches to address three security vulnerabilities affecting its smart switches that could be abused by an adversary to gain full control of a vulnerable device. The flaws, which were discovered and reported to Netgear by...

Huawei HarmonyOS 输入验证错误漏洞

Huawei HarmonyOS is an operating system from Huawei China Inc. A vulnerability exists in the Huawei HarmonyOS component due to an input validation error. The vulnerability stems from a network system or product that does not properly validate input data, and can be exploited by an attacker to...

Reentrancy Bug in TimelockController.sol

Handle leastwood Vulnerability details Impact Notional's governance framework utilises a fork of Compound's Governor Alpha and ERC20 token. These are denoted specifically as the GovernorAlpha.sol and NoteERC20.sol contracts. However, the GovernorAlpha.sol has a key difference when compared to...

Cream Finance DeFi Platform Rooked For $29M

Cream Finance is the latest decentralized finance DeFi platform for cryptocurrency trading to take a major financial hit at the hands of hackers, losing nearly $19 million in an attack this week on its “flash loan” feature. The attacker was able to steal nearly $29 million before being discovered...

Doodle Smart app and Doodle Converter (smart socket) have a flawed logic vulnerability

Doodle Smart is an IoT cloud platform that connects brands, OEMs, developers and chain retailers with their intelligence needs, providing a one-stop AI IoT PaaS-level solution that covers hardware development, global cloud, and smart business platform development, providing comprehensive ecologic...

@hyperledger/cactus-example-carbon-accounting-backend (>=0.5.0-alpha.0, <=0.8.0), @leap-network/pooltogether-proxy-factory (1.0.0-beta.2) +31 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=3.4.0, <=3.4.1)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.5.0-alpha.0, =1.0.0, =1.0.0-beta.1, =0.7.12, =0.3.0, =0.1.0, =0.4.0, =0.7.12, =0.7.12, =0.0.1, =0.7.7, =0.8.18 and more Source cves: CVE-2021-39168 Source advisory: OSV:GHSA-VRW4-W73R-6MM8...

0x-hunter-core (>=1.0.0-33, <=1.0.0-38), @0xabcdefg/router-sdk (1.0.0) +1965 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=3.3.0, <=3.4.1-solc-0.7-2)

@openzeppelin/contracts NPM version =3.3.0, =1.0.0-33, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.0.0, =0.2.0, =4.14.3, =4.14.5 and more Source cves: CVE-2021-39167 Source advisory: OSV:GHSA-FG47-3C2X-M2WR...

Design/Logic Flaw

The management interface of BenQ smart wireless conference projector does not properly control user's privilege. Attackers can access any system directory of this device through the interface and execute arbitrary commands if he enters the local subnetwork...

CVE-2021-37911

CVE-2021-37911 affects BenQ smart wireless conference projectors (data: BenQ EH600/related models). The management interface does not properly enforce user privileges, allowing an attacker on the local subnet to reach arbitrary system directories and execute commands. This is supported by NVD and...

CVE-2020-15744

The CVE-2020-15744 issue affects Victure PC420 smart camera firmware 1.2.2 and earlier, in the ONVIF server component. It is a stack-based buffer overflow that allows remote code execution on the target device. CVSS metrics indicate a high/critical impact with network attack vector, low complexit...

BenQ EH600安全漏洞

The BenQ EH600 is an Android-based business smart projector from China's BenQ. A security vulnerability exists in the BenQ EH600 that stems from the BenQ smart wireless conference projector's management interface not properly controlling user privileges. An attacker can access any system director...

CVE-2021-39168

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

CVE-2021-39167

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

Code injection

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

Code injection

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...