Upgraded Q -> 2 from #83 [1679850055838]

Judge has assessed an item in Issue 83 as 2 risk. The relevant finding follows: L-05 PauseModifier is not used in KangarooVault --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #211 [1679804504433]

Judge has assessed an item in Issue 211 as 2 risk. The relevant finding follows: L-8 VaultToken setVault initialization can be front-runned --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #99 [1679874011180]

Judge has assessed an item in Issue 99 as 2 risk. The relevant finding follows: 02 VaultToken.setVault FUNCTION IS CALLABLE BY ANYONE, AND DEV TEAM'S VaultToken.setVault TRANSACTION CAN BE FRONTRUN BY MALICIOUS ACTOR --- The text was updated successfully, but these errors were encountered: All...

Upgraded Q -> 2 from #179 [1679871876484]

Judge has assessed an item in Issue 179 as 2 risk. The relevant finding follows: L-14 Lack of access control in setVault function leave it vulnerable to frontrunning attack --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #87 [1679862910687]

Judge has assessed an item in Issue 87 as 2 risk. The relevant finding follows: Uninitialized variables --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #88 [1679874664641]

Judge has assessed an item in Issue 88 as 2 risk. The relevant finding follows: L-6 Spamming deposit and withdraw queues --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #88 [1679874611177]

Judge has assessed an item in Issue 88 as 2 risk. The relevant finding follows: L-1 Vault assignment in VaultToken can be frontrunned --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #98 [1679803209669]

Judge has assessed an item in Issue 98 as 2 risk. The relevant finding follows: QA-01 PauseModifier is implemented in the KangarooVault.sol contract but isn't used due to not being apart of core functionality --- The text was updated successfully, but these errors were encountered: All reactions...

super-smash-flash-2.com Cross Site Scripting vulnerability OBB-3234897

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-25153 affecting package moby-containerd for versions less than 1.6.18-2

CVE-2023-25153 affecting package moby-containerd for versions less than 1.6.18-2. An upgraded version of the package is available that resolves this issue...

AZL-25843 CVE-2023-28448 affecting package cloud-hypervisor for versions less than 30.0-2

Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for...

OSV-2023-225 Heap-buffer-overflow in std::__1::enable_if<true, void>::type APFSBtreeNodeIterator<APFSBtreeNode<apfs_o

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57364 Crash type: Heap-buffer-overflow READ 2 Crash state: std::1::enableif::type APFSBtreeNodeIterator ::APFSBtree APFSBtreeNodeIterator APFSBtreeN...

Updated golang packages fix security vulnerability

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. CVE-2022-41723 Large handshake records may cause panics in crypto/tls. CVE-2022-41724 Denial of service from excessive...

MGASA-2023-0109 Updated golang packages fix security vulnerability

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. CVE-2022-41723 Large handshake records may cause panics in crypto/tls. CVE-2022-41724 Denial of service from excessive...

Information Disclosure

jenkins-2-plugins is vulnerable to Information Disclosure. The webhook endpoint provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access, resulting in disclosure of sensitive information...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2023-1583)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header...

Upgraded Q -> 2 from #29 [1679672352018]

Judge has assessed an item in Issue 29 as 2 risk. The relevant finding follows: M-02 Division before multiplication incurs unnecessary precision loss 29 --- The text was updated successfully, but these errors were encountered: All reactions...

Fedora 38 : gmailctl (2023-8c02aee138)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-8c02aee138 advisory. Rebuild for CVE-20220-3064,41717,41723 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 36 : gmailctl (2023-abb47e24d8)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-abb47e24d8 advisory. Rebuild for CVE-20220-3064,41717,41723 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 37 : gmailctl (2023-ca444fdecf)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ca444fdecf advisory. Rebuild for CVE-20220-3064,41717,41723 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...