CVE-2022-39350 @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the...

MED: isOwner / onlyOwner checks can be bypassed by attacker in ERC721/ERC20 implementations

Lines of code Vulnerability details Description ERC20H and ERC721H are base contracts for NFTs / coins to inherit from. They supply the modifier onlyOwner and function isOwner which are used in the implementations for access control. However, there are several functions which when using these the...

PT-2022-24920 · Unknown · Dependency-Track

Name of the Vulnerable Software and Affected Versions: Dependency-Track versions prior to 4.6.0 Description: The issue allows actors with access to the audit log to exploit a flaw and gain access to valid API keys. This occurs when an API request is made using a valid API key with insufficient...

CVE-2022-39351 Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...

MED - NFTs become no longer holographable once new factory is connected.

Lines of code Vulnerability details Description The basic premise of the Holograph platform is that NFTs / ERC20s are holographable, in other words they will have the same address across all ERC20 compatible blockchains. This invariant is used countless times in the code base. For example, when...

Dependency-Track 安全漏洞

Dependency-Track is an intelligent supply chain component analysis platform for identifying third-party component risks. A security vulnerability exists in Dependency-Track versions prior to 4.6.0, which stems from the fact that executing an API request with a valid API key with insufficient...

CVE-2022-39351 Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...

Unbreakable Enterprise kernel security update

5.15.0-3.60.5.1 - fs: remove nollseek Jason A. Donenfeld Orabug: 34721465 - vfio: do not set FMODELSEEK flag Jason A. Donenfeld Orabug: 34721465 - dma-buf: remove useless FMODELSEEK flag Jason A. Donenfeld Orabug: 34721465 - fs: do not compare against -llseek Jason A. Donenfeld Orabug: 34721465 -...

Redemption weight of tiered NFTs miscalculates, making users redeem incorrect amounts - Bug #1

Lines of code Vulnerability details Description Redemption weight is a concept used in Juicebox to determine investor's eligible percentage of the non-locked funds. In redeemParams, JB721Delegate calculates user's share using: uint256 redemptionWeight = redemptionWeightOfdecodedTokenIds; uint256...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:6998)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:6998-1 advisory. - expat: a use-after-free in the doContent function in xmlparse.c CVE-2022-40674 Note that Nessus has not tested for this issue but has instead relied onl...

Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System

terraMaster-CVE-2022-24990 Tool Introduction A quick-use...

CVE-2022-39302 Ree6 may bypass webhook protection

Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel and bypass raid and webhook protection...

CVE-2022-39302 Ree6 may bypass webhook protection

Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel and bypass raid and webhook protection...

etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery

Vulnerability type Data Validation Detail When an etcd instance attempts to perform service discovery, if a cluster size is provided as a negative value, the etcd instance will panic without recovery. References Find out more on this vulnerability in the security audit report For more information...

GHSA-9GP7-6833-WV89 etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery

Vulnerability type Data Validation Detail When an etcd instance attempts to perform service discovery, if a cluster size is provided as a negative value, the etcd instance will panic without recovery. References Find out more on this vulnerability in the security audit report For more information...

etcd user credentials are stored in WAL logs in plaintext

Vulnerability type Data Exposure Workarounds The etcd assumes that the on disk files are secure. The possible fixes have been provided, however, it is the responsibility of the etcd users to make sure that the etcd server WAL log files are secure. The etcd doesn't encrypt key/value data stored on...

GHSA-528J-9R78-WFFX etcd user credentials are stored in WAL logs in plaintext

Vulnerability type Data Exposure Workarounds The etcd assumes that the on disk files are secure. The possible fixes have been provided, however, it is the responsibility of the etcd users to make sure that the etcd server WAL log files are secure. The etcd doesn't encrypt key/value data stored on...

GHSA-H8G9-6GVH-5MRC etcd vulnerable to TOCTOU of gateway endpoint authentication

Vulnerability type Authentication Workarounds Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation. Detail The gateway only authenticates endpoints detected from DNS SRV records, and it only authenticates th...

GHSA-M332-53R6-2W93 etcd's WAL `ReadAll` method vulnerable to an entry with large index causing panic

Vulnerability type Data Validation Detail In the ReadAll method in wal/wal.go, it is possible to have an entry index greater then the number of entries. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime...

etcd's WAL `ReadAll` method vulnerable to an entry with large index causing panic

Vulnerability type Data Validation Detail In the ReadAll method in wal/wal.go, it is possible to have an entry index greater then the number of entries. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime...