CVE-2022-20134

In readArguments of CallSubjectDialog.java, there is a possible way to trick the user to call the wrong phone number due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

no-revert-on-transfer ERC20 tokens can be drained

Lines of code Vulnerability details Impact Some ERC20 tokens don't throw but just return false when a transfer fails. This can be abused to trick the createVault function to initialize the vault without providing any tokens. A good example of such a token is ZRX: Etherscan code When such a vault ...

CVE-2022-22521

In Miele Benchmark Programming Tool with versions Prior to 1.2.71, executable files manipulated by attackers are unknowingly executed with users privileges. An attacker with low privileges may trick a user with administrative privileges to execute these binaries as admin...

PT-2022-16959 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 21.0.8 Nextcloud Server versions prior to 22.2.4 Nextcloud Server versions prior to 23.0.1 Description: The issue allows attackers to trick administrators into enabling unnecessary "recommended" apps for the...

多款 VMware 产品跨站请求伪造漏洞

Vmware vRealize Automation and others are products of Vmware, Inc. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is...

CVE-2022-21830

A blind self XSS vulnerability exists in RocketChat LiveChat v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance...

An Optical Spy Trick Can Turn Any Shiny Object Into a Bug

Anything from a metallic Rubik’s cube to an aluminum trash can inside a room could give away your private conversations...

CVE-2021-4030

A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they coerce or trick a local user to visit a compromised website with malicious scripts...

ROS-20220210-01

A vulnerability in Mozilla Thunderbird email client and Firefox browser is related to incorrect handling of extension updates. Exploitation of the vulnerability could allow an attacker acting remotely to trick the victim into install a particular type of browser extension and, during automatic...

EulerOS Virtualization 3.0.6.0 : ruby (EulerOS-SA-2022-1093)

According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and...

SolarMarker Malware Uses Novel Techniques to Persist on Hacked Systems

In a sign that threat actors continuously shift tactics and update their defensive measures, the operators of the SolarMarker information stealer and backdoor have been found leveraging stealthy Windows Registry tricks to establish long-term persistence on compromised systems. Cybersecurity firm...

PT-2022-15038 · Ghost · Ghost

Name of the Vulnerable Software and Affected Versions: gh-ost versions prior to 1.1.3 Description: The issue is related to an arbitrary file read vulnerability. It requires the attacker to have access to the target host or trick an administrator into executing a malicious gh-ost command, along wi...

Western Digital My Cloud 数据伪造问题漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital. Western Digital My Cloud has a security vulnerability that could allow an attacker to trick a NAS device into loading via an insecure HTTP call. This is the result of insufficient authentication of device calls...

‘Dark Herring’ Billing Malware Swims onto 105M Android Devices

Nearly 500 malicious apps lurking on the Google Play Store have successfully installed Dark Herring malware — a cash-stealer intended to add sneaky charges onto mobile carrier bills — on more than 100 million Android devices across the globe. That’s quite a school of fish. Dark Herring malware wa...

Mozilla: Missing throttling on external protocol launch dialog

The Mozilla Foundation Security Advisory describes this flaw as: Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol...

Mozilla: Missing throttling on external protocol launch dialog

The Mozilla Foundation Security Advisory describes this flaw as: Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol...

Google Chrome 访问控制错误漏洞

Google Chrome is a Web browser from Google, Inc. An access control error vulnerability exists in Google Chrome, which stems from a faulty implementation of Google Chrome's password and could be exploited to create a specially designed Web page that could trick victims into accessing it and...

Google Chrome 安全特征问题漏洞

Google Chrome is a Web browser from Google, Inc. A security feature vulnerability exists in Google Chrome, which stems from a faulty implementation of the product DevTools. A remote attacker could exploit the vulnerability to create a specially crafted web page, trick victims into accessing it, a...

CVE-2021-44942

glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery CSRF vulnerability in /publichtml/admin/plugins/badbehavior2/blacklist.php. Using the CSRF vulnerability to trick the administrator to click, an attacker can add a blacklist...

CVE-2021-43532

The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an...