2109 matches found
Transfer of assets should come before deleting and burning the collateral id
Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Clldata id is burnt and deleted before transfer Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept...
JumpRateModelV2 may return wrong values
Lines of code Vulnerability details JumpRateModelV2 may return wrong values Impact Solidity integer division might truncate. As a result, performing multiplication before division can sometimes avoid loss of precision. Vulnerability Details In general, this is a problem due to precision mostly if...
Get Unified Cloud and Endpoint Security: Only $1 for 1,000 Assets for all of 2023!
As the new year begins, it's more important than ever to protect your business from the constantly evolving cyber threats that could compromise your valuable assets. But who wants to pay an arm and a leg for top-tier security? With this Uptycs introductory offer, you do not have to. Kickstart the...
Get Unified Cloud and Endpoint Security: Only $1 for 1,000 Assets for all of 2023!
As the new year begins, it's more important than ever to protect your business from the constantly evolving cyber threats that could compromise your valuable assets. But who wants to pay an arm and a leg for top-tier security? With this Uptycs introductory offer, you do not have to. Kickstart the...
Malicious code in coolblue-assets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fac07d2b71de3ca79060d86a07a3e16c83b66f3560e38a3be6457b24a4b0afb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-207 Malicious code in coolblue-assets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fac07d2b71de3ca79060d86a07a3e16c83b66f3560e38a3be6457b24a4b0afb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to loader-utils CVE-2022-37599
Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to loader-utils CVE-2022-37599 with details below Vulnerability Details CVEID:CVE-2022-37599 DESCRIPTION: loader-utils is vulnerable to a denial of service, caused by a regular expression denial of...
Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to ansi-regex vulnerability CVE-2021-3807
Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to ansi-regex vulnerability CVE-2021-3807 with details below. Vulnerability Details CVEID:CVE-2021-3807 DESCRIPTION: Chalk ansi-regex module for Node.js is vulnerable to a denial of service, caused b...
Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to Go CVE-2022-32149
Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to Go CVE-2022-32149 with details below. Vulnerability Details CVEID:CVE-2022-32149 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input...
Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to command injection due to Node.js vulnerablity X-Force ID 237819
Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to command injection due to Node.js vulnerablity X-Force ID 237819 with details below Vulnerability Details IBM X-Force ID: 237819 DESCRIPTION: Node.js moment-timezone module could allow a remote attacker to execute arbitrar...
Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to webpack loader-utils vulnerability [CVE-2022-37601]
Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to webpack loader-utils vulnerability with details below. CVE-2022-37601 This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2022-37601 DESCRIPTION: webpack loader-utils could allow a remote attacker to...
Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to man-in-the-middle due to moment vulnerability [X-Force ID 238619]
Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to man-in-the-middle due to moment vulnerability X-Force ID 238619 with details below. This has been addressed. Vulnerability Details IBM X-Force ID: 238619 DESCRIPTION: Moment Moment-Timezone is vulnerable to a...
Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote code execution due to xmldom vulnerability [CVE-2022-37616]
Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote code execution due to xmldom vulnerability with details below. CVE-2022-37616 This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2022-37616 DESCRIPTION: xmldom could allow a remote attacker to...
FIRST DEPOSIT CAN BREAK SHARE CALCULATIONS
Lines of code Vulnerability details Impact Future depositors are forced to pay a huge value of assets to deposit. It is not practically possible for all users. This could directly affect the attrition of users towards this system. Proof of Concept A well-known attack vector for almost all...
TokenggAVAX.sol : First depositor can break minting of shares
Lines of code Vulnerability details Impact A well known attack vector for almost all shares based liquidity pool contracts, where an early user can manipulate the price per share and profit from late users' deposits because of the precision loss caused by the rather large value of price per share...
Possible to block withdrawal of staked funds after recordStakingEnd or stakingError
Lines of code Vulnerability details Impact Node operators can lose their staked AVAX after stakingEnd or stakingError. Funds will be locked in the Staking contract, but impossible to withdraw. A bad actor does need to supply 1000 AVAX which he gets back and has not have real incentive to do it, b...
GHSA-363Q-J92X-7543 Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets
Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...
Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets
Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...
