14443 matches found
[SECURITY] Fedora 36 Update: containerd-1.6.6-1.fc36
Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...
Lack of Two-Step Process for Critical Operations
Lines of code Vulnerability details Impact This function transfers/renounce the ownership of the contract in a single step. There is no way to reverse a one-step transfer of ownership to an address without an owner. This would not be the case if ownership were transferred through a two-step proce...
AutomationDirect C-more EA9 HMI 跨站脚本漏洞
The AutomationDirect C-more EA9 HMI is a series of touchscreen panels from AutomationDirect, Inc. A cross-site scripting vulnerability exists in the AutomationDirect C-more EA9 HMI, which arises from the use of an insecure mechanism to transfer credentials from the client to the web server, which...
The vulnerability of the Web Runtime component of the JD Edwards EnterpriseOne Tools system allows a perpetrator to gain access to and modify data.
The vulnerability of the Web Runtime component of the JD Edwards EnterpriseOne Tools system exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read, modify, add, or delete data using the HTTP protocol...
The vulnerability of the “Loans And Deposits” sub-component of the Oracle FLEXCUBE Universal Banking banking analytics system’s simulation model allows a perpetrator to gain access to and modify data.
The vulnerability of the “Loans And Deposits” sub-component of the Oracle FLEXCUBE Universal Banking banking analytics system’s simulation model exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read,...
The vulnerability of the Outside In Filters component within the Oracle Outside In Technology SDK allows a hacker to trigger a service failure.
The vulnerability of the Outside In Filters component within the Oracle Outside In Technology SDK set is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to trigger a service failure using the HTTP protocol...
The vulnerability of the Client component of the Oracle Secure Global Desktop software allows a hacker to gain full control over the application.
The vulnerability of the Client component of the Oracle Secure Global Desktop software exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the application using the HTTP protocol...
The vulnerability of the Manage Proxies component of the Oracle E-Business Suite automation system allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Manage Proxies component of the Oracle E-Business Suite automation system exists due to insufficient verification of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP...
Security update for chromium (critical)
openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2022:10009-1 Rating: critical References: 1199893 1200139 1200423 Cross-References: CVE-2022-1853 CVE-2022-1854 CVE-2022-1855 CVE-2022-1856 CVE-2022-1857 CVE-2022-1858 CVE-2022-1859 CVE-2022-1860 CVE-2022-1861...
Security update for chromium (important)
openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2022:10005-1 Rating: important References: 1199893 Cross-References: CVE-2022-1853 CVE-2022-1854 CVE-2022-1855 CVE-2022-1856 CVE-2022-1857 CVE-2022-1858 CVE-2022-1859 CVE-2022-1860 CVE-2022-1861 CVE-2022-1862...
The vulnerability of the Application Service component of the software for working with Oracle Web Applications Desktop Integrator allows a perpetrator to gain access to modify, add, or delete data, or to gain unauthorized access to protected information.
The vulnerability of the Application Service component of the Oracle Web Applications Desktop Integrator software exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or gain unauthorized...
CVE-2022-32559
An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics...
CVE-2022-27219
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. Affected application is missing general HTTP security headers in the web server configured on port 443. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks a...
CVE-2021-30338
Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Compute...
Input validation
Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Compute...
wfCashERC4626.sol#redeem() Lack of slippage control for market sell
Lines of code Vulnerability details function redeem uint256 shares, address receiver, address owner public override returns uint256 // It is more accurate and gas efficient to check the balance of the // receiver here than rely on the previewRedeem method. uint256 balanceBefore =...
Approve Returned Value Not Validated
Lines of code Vulnerability details Proof-of-Concept The approve function attempts to performs an ERC20.approve call, but does not check if the returned value is true Succeed or false Failed. Some tokens do not revert if the approval failed but return false instead. / @dev Approve the given...
User can alter amount returned by redeem function due to control transfer
Lines of code Vulnerability details Impact Control is transferred to the receiver when receiving the ERC777. They are able to transfer the ERC777 to another account, at which time the before and after balance calculation will be incorrect. uint256 balanceBefore = IERC20asset.balanceOfreceiver; if...
Upgraded Q -> M from 182 [1655245716777]
Judge has assessed an item in Issue 182 as Medium risk. The relevant finding follows: L-Can send ETH more than buyOption premium required Link. requiremsg.value = premium should be requiremsg.value == premium to prevent user send too much eth. Only beneficiary benefit from this. Contract should...