delegateTo Function of NounsDAOProxyV2 Contract can execute arbitrary code and modify the storage

Lines of code Vulnerability details Impact The delegateTo function delegates execution to another contract using the delegatecall opcode without performing any input validation or checking the returned success flag, the problem is The delegated contract can execute arbitrary code and modify the...

PT-2023-8665 · Google +6 · Android +7

Name of the Vulnerable Software and Affected Versions: wpa supplicant versions through 2.10 Description: The issue is related to the implementation of PEAP in wpa supplicant, which allows authentication bypass. For a successful attack, wpa supplicant must be configured to not verify the network's...

Snowden Ten Years Later

In 2013 and 2014, I wrote extensively about new revelations regarding NSA surveillance based on the documents provided by Edward Snowden. But I had a more personal involvement as well. I wrote the essay below in September 2013. The New Yorker agreed to publish it, but the Guardian asked me not to...

Why Attackers Target the Gaming Industry

Key Takeaways: The gaming industry is a common target for cyberattacks due to its financial success and vast user base. Volumetric DDoS attacks can disrupt service, distract from more serious attacks, and cause financial damage, especially on sites that offer online multiplayer games or real-time...

CVE-2023-25314

Cross Site Scripting XSS vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user...

PT-2023-20025 · Avideo · Avideo

Name of the Vulnerable Software and Affected Versions: AVideo versions prior to 12.4 Description: The issue allows attackers to gain sensitive information via the success parameter to the "/user" API endpoint. This is a Cross Site Scripting XSS vulnerability, which means attackers can inject...

GHSA-W9G2-3W7P-72G9 Incorrect success value returned in vyper

Background During the audit of Lido's Gate Seals code statemind team identified a weird behavior of the code that uses rawcall: https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vyL164 . Construction like this: vyper success = rawcall...

Chatbots, Celebrities, and Victim Retargeting: Why Crypto Giveaway Scams Are Still So Successful

...

answer 安全漏洞

answer is an open source knowledge-based community software. An information disclosure vulnerability exists in versions of answer prior to 1.0.6. The vulnerability stems from the fact that the application will respond with an account that cannot be found if an invalid account is used. In the case...

SourceCodester Friendly Island Pizza Website and Ordering System SQL注入漏洞

SourceCodester Friendly Island Pizza Website and Ordering System is the Island Pizza website and ordering system. A SQL injection vulnerability exists in version 1.0 of the SourceCodester Friendly Island Pizza Website and Ordering System due to unknown code in the file paypalsuccess.php in the...

The benefits of a customer-centric cloud security mindset

Why a customer focus unlocks new levels of innovation and enables security team success...

SUSE CVE-2006-4925

packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service crash by sending an invalid protocol sequence with USERAUTHSUCCESS before NEWKEYS, which causes newkeysmode to be NULL...

SUSE CVE-2006-5170

pamldap in nssldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pamauthenticate function to return a success cod...

SUSE CVE-2015-8023

The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message...

SUSE CVE-2021-28709

issues with partially successful P2M updates on x86 This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. x86 HVM and PVH guests may be started in populate-on-demand PoD mode, to provide a way for them to later easily have...

SUSE CVE-2021-45079

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2 even without server authentication...

A Customer Success Manager’s Journey to Cybersecurity

Originally planning to pursue a career in sports journalism, Blake Walters joined Rapid7 ready to roll up his sleeves and learn about an entirely new field—cybersecurity. Walters always had an interest in computer engineering. However, he craved the ability to connect with people and build...

Do more with less with Microsoft Security—3 strategies to get you started

Relentless bad actors, evolving attack tactics, and numerous surfaces and endpoints that attackers may try to exploit. With the average cost of a data breach reaching an all-time high of USD4.35 million in 2022,1 protecting your people and data from adversaries is more important than ever. Plus,...

Rapid7 Recognized as a Top Place to Work for 11th Consecutive Year

On November 30th, 2022, Rapid7 was again recognized by The Boston Globe as a Top Place to Work in Massachusetts. This marks the 11th consecutive year Rapid7 has made the list, this time coming in at 3 in the large company category. Top Places to Work rankings are based on a Globe survey that...

Behind The Success Of Phenomenon Game Fortnite

By Owais Sultan Did you know Fortnite was the first game to break through on a variety of console platforms, including XBOX/PS/Switch? This is a post from HackRead.com Read the original post: Behind The Success Of Phenomenon Game Fortnite...