User can set auctioneer to address(0) to prevent vault from being liquidated

Lines of code Vulnerability details Impact Vault cannot be liquidated Proof of Concept auction can be called with any address as the 'to' address. A majority of ERC20 tokens will revert if a transfer is initiated to address0, notably, including USDC. Since the auctioneer is paid each time a payme...

[SECURITY] Fedora 36 Update: gotun-0-0.14.gita9dbe4d.fc36

Tool to run tests on OpenStack...

SUSE SLES15 Security Update : apache2 (SUSE-SU-2022:2338-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2338-1 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows a...

[SECURITY] Fedora 36 Update: golang-github-crossdock-0-0.8.20190628git049aabb.fc36

A Go client for Crossdock...

Huawei MindSpore Community numeric error vulnerability

Huawei MindSpore Community is an open source deep learning framework from Huawei China.A numerical error vulnerability exists in versions prior to Huawei MindSpore Community 1.3.0, which stems from the fact that when performing the initialization operation of the Split operator, if a dimension in...

CVE-2021-40663

deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

2022 0-day In-the-Wild Exploitation…so far

Posted by Maddie Stone, Google Project Zero This blog post is an overview of a talk, “ 0-day In-the-Wild Exploitation in 2022…so far”, that I gave at the FIRST conference in June 2022. The slides are available here. For the last three years, we’ve published annual year-in-review reports of 0-days...

deep-assign 安全漏洞

deep-assign is an npm package. A security vulnerability exists in the npm package deep.assign version 0.0.0-alpha.0, which is vulnerable to "prototype contamination"...

CVE-2022-31887

Marval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organization, this means that the user can also escalate achieve Privilege Escalation by changing the administrator password...

CVE-2022-31887

CVE-2022-31887 affects Marval MSM v14.19.0.12476 and enables a 0-click account takeover that allows an attacker to change any user’s password within the organization, which can lead to privilege escalation by altering the administrator password. The issue is described consistently across sources ...

CVE-2022-31087 Incorrect Default Permissions in ldap-account-manager

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php and .php5/.php4/.phpt/etc files. An attacker capable of writing...

CVE-2021-33654

When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cause a division by 0 exception...

CVE-2021-33651

When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depthmultiplier is 0, it will cause a division by 0 exception...

CVE-2021-33652

When the Reduce operator run operation is executed, if there is a value of 0 in the parameter axissizes element, it will cause a division by 0 exception...

CVE-2021-33653

When performing the derivation shape operation of the SpaceToBatch operator, if there is a value of 0 in the parameter blockshape element, it will cause a division by 0 exception...

Code injection

When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depthmultiplier is 0, it will cause a division by 0 exception...

Code injection

When performing the derivation shape operation of the SpaceToBatch operator, if there is a value of 0 in the parameter blockshape element, it will cause a division by 0 exception...

Design/Logic Flaw

When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cause a division by 0 exception...

Design/Logic Flaw

When the Reduce operator run operation is executed, if there is a value of 0 in the parameter axissizes element, it will cause a division by 0 exception...

CVE-2021-33654

When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cause a division by 0 exception...