Missing modifier allow infinite mint for tier

Lines of code Vulnerability details Impact It seems mintReservesFor function is missing the onlyOwner modifier which means Attacker can call this function to mint any amount of reserved tokens Proof of Concept 1. Observe the mintReservesFor function function...

PT-2022-21748 · Qualcomm · Snapdragon

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon affected versions not specified Description: The issue is related to memory corruption in display due to time-of-check time-of-use of metadata reserved size. This affects various Snapdragon products, including Snapdragon...

CVE-2022-41292

IBM Robotic Process Automation is vulnerable to HTTP header injection due to improper validation of input in the HOST headers (CVE-2022-41292). Affects IBM Robotic Process Automation for Cloud Pak (< 21.0.4), IBM Robotic Process Automation as a Service (< 21.0.4), and IBM Robotic Process Au...

CVE-2020-35282

The connected IBM advisories confirm CVE-2020-35282 affects IBM WebSphere Application Server (WAS) when shipped with IBM Operations Analytics Predictive Insights. Affected: WAS 8.0, 8.5, 9.0 as part of Predictive Insights; vulnerability type: Server-Side Request Forgery (and related spoofing/remo...

BlurExchange Contract May Not Be Upgradeable

Lines of code Vulnerability details Vulnerability Details The BlurExchange is designed to be an implementation contract supporting an upgradeable feature. However, we found that some contracts define state variables without allocating the reserved storage slots gap which may impede the BlurExchan...

CVE-2021-39673

CVE-2021-39673 is publicly documented in Android bulletin contexts as a high-severity issue listed under the 2022-10 patch levels for Android 13 (AOSP 13). Connected documents show it alongside other CVEs with Android patch-level mappings (e.g., CVE-2022-20419 and CVE-2022-20412) and explicitly c...

PT-2022-34605 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.9 Description: The issue concerns a potential security vulnerability in the Linux Kernel. It is related to the regmap: spi, where space for register address/padding is reserved. The actual impact and attac...

CVE-2019-4662

IBM FileNet Content Manager and Case Foundation ACCE contain multiple vulnerabilities including CVE-2019-4662. Affected: FileNet Content Manager and Case Foundation 5.5.2 and 5.5.3. Root cause: authorization tokens or session cookies are not marked as Secure, allowing cookie leakage over insecure...

CVE-2019-4717

IBM Jazz for Service Management (JazzSM) is affected by a cross-site scripting (XSS) vulnerability (CVE-2019-4717) in version 1.1.3. The issue enables a remote attacker to inject arbitrary JavaScript into the Web UI, potentially altering functionality and leading to credentials disclosure within ...

CVE-2019-4532

CVE-2019-4532 affects IBM Resilient OnPrem. The vulnerability exists in IBM Resilient versions 33.x and 34.0 where the platform does not properly limit the number or frequency of interactions with an actor (e.g., password reset requests). This could enable abuse of reset flows. Remediation: upgra...

CVE-2019-4097

CVE-2019-4097 is a spoofing vulnerability in Platform System Manager (PSM) shipped with IBM Cloud Pak System/PureApplication System. An authenticated user could steal or manipulate customer sessions and cookies. Affected product: IBM Cloud Pak System (V2.3.0). CVSS Base score 4.3. Remediation: up...

CVE-2019-4096

CVE-2019-4096 is an IBM Cloud Pak System vulnerability describing inadequate account lockout settings that could allow remote brute-forcing of credentials. IBM Cloud Pak System V2.3.0 is affected; remediation is to upgrade to V2.3.0.1. The IBM security bulletins note the vulnerability is resolved...

CVE-2022-1972

Removed by vendor...

CVE-2022-22403

IBM Aspera Faspex 5.0.0 and 5.0.1 are affected by CVE-2022-22403. The root cause is that authorization tokens or session cookies are not set with the Secure attribute, enabling an attacker to snoop cookie values when a user visits an insecure http link or a compromised site. IBM has addressed thi...

CVE-2022-25704

CVE-2022-25704 is listed in the Android/Qualcomm Bluetooth vulnerability set as a high-severity issue affecting Qualcomm closed-source components. Connected sources indicate it is part of the 2022 Android security update; no exploitation details are provided in the supplied documents. Remediation...

CVE-2022-35958

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-37458. Reason: This candidate is a reservation duplicate of CVE-2022-37458. Notes: All CVE users should reference CVE-2022-37458 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2019-4518

CVE-2019-4518 is associated with IBM Financial Transaction Manager family (Digital Payments, Corporate Payment Services, ACH, Check services). The connected IBM security bulletins confirm a validation weakness where input is not properly validated, potentially allowing an authenticated user to is...

CVE-2020-4275

CVE-2020-4275: Cross-site scripting in the Carbon Black Response add-on for IBM QRadar SIEM. Affects Carbon Black Response versions 1.0.1–1.3.0. The vulnerability allows injecting arbitrary JavaScript into the Web UI, potentially leaking credentials within a trusted session. Root cause: improper ...

CVE-2019-4599

IBM Sterling Connect:Express for UNIX FTP Server is affected by a heap-based buffer overflow in the FTP service (CVE-2019-4599). The issue arises from improper bounds checking in the ALLO handling of the FTP server, where the static buffer in BSS (rem_file) can overflow when processing input with...

CVE-2019-14661

Summary : IBM Operations Analytics Predictive Insights is affected by CVE-2019-14661 (and related Jackson-databind CVEs). The IBM security bulletins state that Jackson-databind is used (limited to the REST Mediation utility) and that the product has been addressed for these CVEs. Affected product...