_safeMint Will Fail Due To An Edge Case In Calculating tokenId Using The _generateNewTokenId Function

Handle leastwood Vulnerability details Impact NFTs are used to represent unique positions referenced by the generated tokenId. The tokenId value contains the position's score in the upper 128 bits and the index wrt. the token supply in the lower 128 bits. When positions are unlocked after expirin...

panorama Mobile One Time Password SQL Injection Vulnerability

panorama Mobile One Time Password MOTP is a mobile dynamic password system of China Panorama. With a solid two-factor authentication mechanism, through the OTP dynamic password constantly changing characteristics, effectively solve the problem of account, password theft, to ensure the security of...

New Android Malware Targeting Brazil's Itaú Unibanco Bank Customers

Researchers have discovered a new Android banking malware that targets Brazil's Itaú Unibanco with the help of lookalike Google Play Store pages to carry out fraudulent financial transactions on victim devices without their knowledge. "This application has a similar icon and name that could trick...

New Android Malware Targeting Brazil's Itaú Unibanco Bank Customers

Researchers have discovered a new Android banking malware that targets Brazil's Itaú Unibanco with the help of lookalike Google Play Store pages to carry out fraudulent financial transactions on victim devices without their knowledge. "This application has a similar icon and name that could trick...

Google Android Information Disclosure Vulnerability (CNVD-2021-101960)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an information disclosure vulnerability that can be exploited by attackers to cause local information disclosure across Binder transactions without additional execution privileges...

CoAP Protocol: Definition, Architecture

Professionals involved in IoT network designing or development must have come across CoAP. A dedicatedly set standard by IETF, it works the best when it comes to constrained IoT-enabled solutions. To make you understand CoAP Constrained Application Protocol better, we have prepared this post,...

CVE-2021-0966

In code generated by BuildParcelFields of generatecpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process due to uninitialized data. This could lead to local information disclosure across Binder transactions with no additional execution...

CVE-2021-0966

In code generated by BuildParcelFields of generatecpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process due to uninitialized data. This could lead to local information disclosure across Binder transactions with no additional execution...

Information disclosure

In code generated by BuildParcelFields of generatecpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process due to uninitialized data. This could lead to local information disclosure across Binder transactions with no additional execution...

CVE-2021-0966

CVE-2021-0966 affects Android 11 and 12. It arises from BuildParcelFields in generate_cpp.cpp, allowing a crafted parcelable to reveal uninitialized memory in a target process and cause local information disclosure across Binder transactions without extra privileges or user interaction. Impact is...

Approved by zero first

Handle Jujic Vulnerability details Some tokens like USDT do not work when changing the allowance from an existing non-zero allowance value. They must first be approved by zero and then the actual allowance must be approved. Impact When using one of these unsupported tokens, all transactions rever...

CVE-2021-41272 SHL, SHR, and SAR operations trigger native exception at key values in besu

Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error in values that represent negative values for 32 bit signed integers. Smart contracts that ask for...

Matkt Hyperledger Besu 安全漏洞

Matkt Hyperledger Besu is an open source application from Matkt. It is used to run, maintain, debug and monitor nodes in the Ethernet network. A security vulnerability exists in Besu starting in version 21.10.0, which stems from changes in the software implementation of the SHL, SHR, and SAR...

Google Android 信息泄露漏洞

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an information disclosure vulnerability that can be exploited by attackers to cause local information disclosure across Binder transactions without additional execution privileges...

firefly-iii 跨站请求伪造漏洞

firefly-iii is a free and open source personal finance manager. firefly-iii suffers from a cross-site request forgery vulnerability, which can be exploited by attackers via /transactions/link/switch/id...

ASB-A-198346478

In code generated by BuildParcelFields of generatecpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process due to uninitialized data. This could lead to local information disclosure across Binder transactions with no additional execution...

More Stealthier Version of BrazKing Android Malware Spotted in the Wild

Banking apps from Brazil are being targeted by a more elusive and stealthier version of an Android remote access trojan RAT that's capable of carrying out financial fraud attacks by stealing two-factor authentication 2FA codes and initiating rogue transactions from infected devices to transfer...

python-ecdsa: DER encoding is not being verified in signatures

A flaw was found in python-ecdsa, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false...

@avalabs/avalanche-wallet-sdk (>=0.9.5 <=0.10.2), @b0dhidharma/contract-utils (=0.1.1) +66 more potentially affected by unknown CVE via @openzeppelin/contracts (>=4.2.0 <=4.3.2)

@openzeppelin/contracts NPM version =4.2.0, =0.9.5, =0.0.2, =0.0.1, =0.0.1, =1.0.0, =0.0.1, =1.1.0, =0.0.1, =3.0.0-alpha.2, =3.0.0-alpha.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =3.0.0-alpha.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WMPV-C2JP-J2XG...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - July 2021 - Includes Oracle July 2021 CPU minus CVE-2021-2341 affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 ,version 8, that is used by IBM Tivoli Composite Application Manager for Transactions - Robotic Response Time. These issues were disclosed as part of the IBM Java SDK updates in July 2021. Vulnerability...