8504 matches found
When admin sets fee parameters on a pair, it is guaranteed to corrupt the critical static fee parameters.
Lines of code Vulnerability details Description Factory owner can configure fee parameters of any pair using setFeesParametersOnPair. The actual change in pair storage happens in setFeeParameters: function setFeesParametersbytes32 packedFeeParameters internal bytes32 feeStorageSlot; assembly...
Content-Security-Policy protection for user content disabled by Jenkins NeuVector Vulnerability Scanner Plugin
Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. NeuVector Vulnerability Scanner Plugin 1.20 and earlier globally disables the...
CVE-2022-41853
A flaw was found in the HSQLDB package. This flaw allows untrusted inputs to execute remote code due to any static method of any Java class in the classpath, resulting in code execution by default. Mitigation By default, the static methods of any class that is on the classpath are available for u...
Content-Security-Policy protection for user content disabled by NeuVector Vulnerability Scanner
Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. NeuVector Vulnerability Scanner 1.20 and earlier globally disables the...
Content-Security-Policy protection for user content can be disabled in 360 FireLine
Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. 360 FireLine 1.7.2 and earlier globally disables the Content-Security-Policy...
Content-Security-Policy protection for user content disabled by XFramium Builder
Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. XFramium Builder 1.0.22 and earlier globally disables the Content-Security-Poli...
PT-2022-25929
Name of the Vulnerable Software and Affected Versions Mobile Security Framework MobSF versions 0.9.2 and below Description The issue allows attackers to read arbitrary files via a crafted HTTP request, exploiting a local file inclusion LFI vulnerability in the StaticAnalyzer/views.py script...
Top 5 ransomware detection techniques: Pros and cons of each
In the fight against ransomware, much of the discussion revolves around prevention and response. Actually detecting the ransomware, however, is just as important to securing your business. To understand why, just consider the following example. Lets say youre a farmer taking care of a flock of...
Dont check return type
Lines of code Vulnerability details Impact Dont check return type Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Add suitable checks --- The text was updated successfully, but these errors were encountered: š 1 trust1995 reacted with thumbs down emoji All reactions š 1...
GO-2022-1031 Open redirect in github.com/labstack/echo/v4
Labstack Echo contains an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery SSRF...
HSQLDB Code Execution Vulnerability
HSQLDB is a relational database management system written in Java by The HSQL Development Group team. A code execution vulnerability exists in HSQLDB, which stems from the fact that its use of java.sql.Statement or java.sql.PreparedStatement to process untrusted input by default allows any static...
Passing chain id from outside
Lines of code Vulnerability details Impact Passing chain id from outside. Incorrect chain id can be passed. Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Use assembly to obtain current chain id. --- The text was updated successfully, but these errors were encountered:...
Transfer reminder of msg.value is bad practice
Lines of code Vulnerability details Impact Transfer reminder of msg.value is bad practice. Can lead to out of gas, reentrancy and so on. Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Can create method getReminder and user to call to get all reminders for him. --- The...
GHSA-77XX-RXVH-Q682 HyperSQL DataBase vulnerable to remote code execution when processing untrusted input
Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb HyperSQL DataBase to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can...
HSQLDB å®å Øę¼ę“
HSQLDB is a relational database management system written in Java by The HSQL Development Group team. A code execution vulnerability exists in HSQLDB, which stems from the fact that its use of java.sql.Statement or java.sql.PreparedStatement to process untrusted input by default allows any static...
GO-2022-1027 Path traversal in github.com/cloudwego/hertz
Improper path sanitization on Windows permits path traversal attacks. Static file serving with the Static or StaticFS functions allows an attacker to access files from outside the filesystem root. This vulnerability does not affect non-Windows systems...
Server-Side Request Forgery (SSRF)
github.com/labstack/echo is vulnerable to server side request forgery. The vulnerability exists due to a lack of sanitization of URL via the Static Handler component allowing an attacker to redirect a user to a malicious website...
Design/Logic Flaw
A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control SD-AVC on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static username and password combination. This vulnerability exists...
Labstack Echo Open Redirect vulnerability
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery SSRF. Version 4.9.0 contains a patch for the issue...
GHSA-CRXJ-HRMP-4RWF Labstack Echo Open Redirect vulnerability
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery SSRF. Version 4.9.0 contains a patch for the issue...