Adobe Bridge Buffer Overflow Vulnerability (CNVD-2022-60082)

Adobe Bridge is a free digital asset management application from Adobe. A buffer overflow vulnerability exists in Adobe Bridge 11.1.1 and earlier versions. An attacker can exploit the vulnerability to execute arbitrary code...

Adobe Bridge out-of-bounds read vulnerability (CNVD-2022-60081)

Adobe Bridge, a free digital asset management application from Adobe, is vulnerable to an out-of-bounds read vulnerability in Adobe Bridge 11.1.1 and earlier. An attacker could exploit the vulnerability to execute arbitrary code...

Uniswap / Sushiswap prices can be manipulated through flashloans

Handle cmichel Vulnerability details The UniswapV2CSSR.getExchangeRatio uses the current reserve to derive the exchange ratio. The fact that it mixes in historic data does not matter because it still uses the current reserves which can be manipulated through flashloans in currentPriceCumulative...

Adobe Bridge Memory Corruption Vulnerability

Adobe Bridge is a free digital asset management application from Adobe. A memory corruption vulnerability exists in Adobe Bridge 11.1.1 and earlier versions. An attacker can exploit the vulnerability to execute arbitrary code...

Adobe Bridge Memory Corruption Vulnerability (CNVD-2022-67851)

Adobe Bridge is a free digital asset management application from Adobe. 11.1.1 and earlier versions of Adobe Bridge contain a memory corruption vulnerability that could be exploited by attackers to execute arbitrary code in the context of the current user...

Defending Assets You Don’t Know About Against Cyberattacks

Back in the 90s, we all used to build massive firewalls around our systems and spent our day-to-day resources looking for holes to patch. In theory, an impenetrable wall around everything you own is a great idea, because it protects even the things you’ve forgotten about. However, if a wall is yo...

registerAsset would change asset class of existing asset

Handle jonah1005 Vulnerability details Impact The permissionless function registerAsset only checks current liquidity. There's no sanity check whether the asset has registered as another asset class. An attacker can set an asset into AssetClass.Sigma. Unexpected liquidation would happen if an Alp...

Security Bulletin: IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities

Summary IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities with details below Vulnerability Details CVEID: CVE-2021-22931 DESCRIPTION: Node.js could provide weaker than expected security, caused by missing input validation on hostnames returned by DNS servers. An...

Snipe-IT Cross-Site Scripting Vulnerability (CNVD-2022-19844)

Snipe-IT is an open source IT asset/license management system. Snipe-IT suffers from a cross-site scripting vulnerability that stems from the fact that the program is vulnerable to incorrect input during web page generation, which could be exploited by an attacker to execute arbitrary JavaScript...

Snipe-IT Cross-site Request Forgery Vulnerability (CNVD-2022-19843)

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to cross-site request forgery, which could be exploited by attackers to obtain sensitive information...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM DB2 shipped with IBM Maximo Asset Management (CVE-2021-29763, CVE-2021-29752 and CVE-2021-29825)

Summary IBM DB2 is shipped as a component of IBM Maximo Asset Management. Information about the security vulnerability affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Snipe-IT 跨站请求伪造漏洞

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to cross-site request forgery, which could be exploited by attackers to obtain sensitive information...

Security Bulletin: IBM Cloud Pak for Integration is vulnerable to jzsip (CVE-2021-23413)

Summary IBM Cloud Pak for Integration is vulnerable to jzsip CVE-2021-23413 with details below Vulnerability Details CVEID: CVE-2021-23413 DESCRIPTION: jszip is vulnerable to a denial of service, caused by a prototype pollution flaw. By using a specially-crafted zip file with filenames set to...

Security Bulletin: IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities

Summary IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities with details below Vulnerability Details CVEID: CVE-2021-22930 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by a use-after-free on close http2 on stream canceling...

Deposits don't work with fee-on transfer tokens

Handle cmichel Vulnerability details There are ERC20 tokens that may make certain customizations to their ERC20 contracts. One type of these tokens is deflationary tokens that charge a certain fee for every transfer or transferFrom. Others are rebasing tokens that increase in value over time like...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2021-29842)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...

Security Bulletin: IBM Cloud Pak for Integration is vulnerable to Go vulnerability CVE-2021-31525

Summary IBM Cloud Pak for Integration is vulnerable to Go vulnerability CVE-2021-31525 with details below Vulnerability Details CVEID: CVE-2021-31525 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in net/http. By sending a specially-crafted header to ReadRequest or...

IndexPool.mint The first liquidity provider is forced to supply assets in the same amount, which may cause a significant amount of fund loss

Handle WatchPug Vulnerability details When reserve == 0, amountIn for all the tokens will be set to the same amount: ratio, regardless of the weights, decimals and market prices of the assets. The first liquidity provider may not be aware of this so that it may create an arbitrage opportunity for...

Security Bulletin: Rational Asset Analyzer is affected by a WebSphere Application Server vulnerability.

Summary WebSphere Application Server Liberty used by Rational Asset Analyzer is vulnerable to an XML External Entity Injection XXE vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-20492 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batc...

Jira Service Management / Insight Asset Management vulnerable to RCE Security

Description Insight - Asset Management has a feature to import data from several databases DBs. One of these DBs, the H2 DB, has a native function in its library which an attacker can use to run code on the server remote code execution a.k.a. RCE. The H2 DB is bundled with Jira to help speed up...