Not reverting on failing ERC20 transfer

Handle Sherlock Vulnerability details Impact In the Visor.sol contract an IERC20 transferFrom with an arbitrary token argument is used. The return value of the transferFrom is not used, a boolean indicating if the transaction succeeded. Meaning the transaction could succeed without the actual...

CVE-2021-20996

In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties...

CVE-2021-20996

The CVE-2021-20996 entry concerns WAGO managed switches. Affected product: multiple WAGO managed switches across different versions. Vulnerability: specially crafted requests can cause cookies to be transferred to third parties, exposing session-related data. Root cause details are limited in the...

Apple’s ‘Find My’ Network Exploited via Bluetooth

Apple’s “Find My device” function for helping people track their iOS and macOS devices can be exploited to transfer data to and from random passing devices without using the internet, a security researcher has demonstrated. Security researcher Fabian Bräunlein with Positive Security developed a...

WAGO 安全漏洞

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. The device is designed for use in industrial environments as an electronic system for the operation of digital algorithms. A security vulnerability exists in WAGO. An attacker could use a specially crafted request to cause...

Unchecked return value of transfer in NFTXFeeDistributor

Handle shw Vulnerability details Impact The function rescueTokens in the contract NFTXFeeDistributor does not check the return value of transfer. It is possible that the transferred assets are not ERC20-compliant e.g., returns a false when a transfer fails, leading to unexpected results. Proof of...

The vulnerability of the Bank Account Transfer component in the Oracle Cash Management application of the Oracle E-Business Suite allows a malicious individual to gain access to modify, add, or delete data, as well as to unauthorizedly access protected information.

The vulnerability of the Bank Account Transfer component in the Oracle Cash Management application of the Oracle E-Business Suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, as well as gai...

The vulnerability of the sub-components “Loan Details” and “Loan Accounting Events” of the Oracle Loans component in the Oracle E-Business Suite, a business automation system, allows a malicious individual to gain unauthorized access to the device.

The vulnerability of the Loan Details and Loan Accounting Events subcomponents of the Oracle Loans component in the Oracle E-Business Suite is related to code errors. Exploitation of this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the device through HT...

The vulnerability of the Gateway component of the Oracle Secure Global Desktop software allows a hacker to gain full control over the application.

The vulnerability of the Oracle Secure Global Desktop software’s Gateway component is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the HTTP protocol...

The vulnerability of the Quote sub-component of the Oracle Lease and Finance Management component in the Oracle E-Business Suite system allows a malicious individual to gain unauthorized access to the device.

The vulnerability of the Quotes sub-component of the Oracle Lease and Finance Management component within the Oracle E-Business Suite automation system is related to code errors. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the device...

The vulnerability of the Message Display component of the Oracle Email Center messaging software in the Oracle E-Business Suite, a business automation system, allows a malicious individual to access, modify, add, or delete data, or gain full control over the application.

The vulnerability of the Message Display component of the Oracle Email Center messaging software, a part of the Oracle E-Business Suite for enterprise automation, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or...

PT-2021-3092

Name of the Vulnerable Software and Affected Versions Microsoft HTTP Protocol Stack versions prior to the fixed version Description The issue is related to a memory usage problem after memory release in the HTTP Protocol Stack of Microsoft Windows operating systems. This can be exploited by a...

Oracle Linux 8 : squid:4 (ELSA-2020-3623)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3623 advisory. - Resolves: 1872345 - CVE-2020-15811 squid:4/squid: HTTP Request Splitting could result in cache poisoning - Resolves: 1872330 - CVE-2020-15810...

Exim buffer overflow vulnerability (CNVD-2021-34534)

Exim was developed at Cambridge University as a Message Transfer Agent MTA for Unix systems connected to the Internet. Exim suffers from a buffer overflow vulnerability. The vulnerability stems from a "-F" handling error in parsefixphrase. No details of the vulnerability are available at this tim...

Exim buffer overflow vulnerability (CNVD-2021-34531)

Exim was developed at Cambridge University as a Message Transfer Agent MTA for Unix systems connected to the Internet. A heap buffer overflow vulnerability exists in queuerun in Exim, which can be exploited by an attacker to elevate privileges from exim to root via the two sender options -R and -...

Exim Integer Overflow Vulnerability

Exim was developed at Cambridge University as a Message Transfer Agent MTA for Unix systems connected to the Internet. An integer overflow vulnerability exists in getstdinput in Exim. No detailed vulnerability details are provided at this time...

Unspecified Vulnerability in Exim

Exim was developed at Cambridge University as a Message Transfer Agent MTA for Unix systems connected to the Internet. Exim has a security vulnerability. An attacker can exploit the vulnerability by authenticating a remote SMTP client to insert line breaks into a fake offline file via AUTH= in th...

Unspecified Vulnerability in Exim (CNVD-2021-34533)

Exim was developed at Cambridge University as a Message Transfer Agent MTA for Unix systems connected to the Internet. A security vulnerability exists in Exim. The vulnerability stems from the fact that recipient addresses can have newline characters, which can be exploited by a local attacker to...

Missing allValidNFTs and afterRedeemHook with swapTo?

Handle gpersoon Vulnerability details Impact The function swapTo of NFTXVaultUpgradeable.sol is kind of a combination of mintTo and redeemTo the code looks very similar to a combination of mintTo and redeemTo. Before receiveNFTs I would expect a call to allValidNFTs, like in mintTo. This is to ma...

Exim Arbitrary File Deletion Vulnerability

Exim was developed at Cambridge University as a Message Transfer Agent MTA for Unix systems connected to the Internet. Exim suffers from an arbitrary file deletion vulnerability that can be exploited by a local attacker to delete arbitrary files as root via the deletepidfile contention condition...