6442 matches found
upgradeRandProvider could be bricked if still waiting for seed
Lines of code Vulnerability details Impact The updgradeRandProvider function exists in case the chainlink randomness provider is phased out in the long term future. It is impossible to upgrade the randomness provider while the contract is still waiting for a seed. This is a reasonable thing to...
Security Bulletin: Privilege escalation vulnerability in IBM DB2's Audit Facility (CVE-2013-3475).
Abstract Vulnerability in IBM DB2's Audit Facility could allow an escalation of privilege attack. Content VULNERABILITY DETAILS CVE ID: CVE-2013-3475 Description: The IBM DB2 products listed below contain a security vulnerability in the DB2 Audit Facility which allows an attacker to gain DB2...
Security Bulletin: IBM InfoSphere Balanced Warehouse D5100 and IBM Smart Analytics System 5600 are affected by a privilege escalation vulnerability in the DB2 Audit Facility (CVE-2013-3475)
Abstract IBM InfoSphere Balanced Warehouse D5100 and IBM Smart Analytics System 5600 are shipped with DB2 9.7. This version of DB2 contains a security vulnerability in the DB2 Audit Facility which allows an attacker to gain DB2 instance owner level privileges. This vulnerability can only be...
Time rounding can cause users to not be able to withdraw all the funds they are eligible for
Lines of code Vulnerability details Impact The time that has passed from the start of the vest is rounded down to the closest multiplication of claim.releaseIntervalSecs. The user can claim the funds for an interval only at the end of it. That means that users can't withdraw the funds for a part ...
CVE-2022-38617
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the voiceAudit:jid97 parameter at /SVFE2/pages/audit/voiceaudit.jsf...
CVE-2022-38617
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the voiceAudit:jid97 parameter at /SVFE2/pages/audit/voiceaudit.jsf...
SmartVista SVFE2 SQL注入漏洞
SmartVista SVFE2 is a subsystem of SmartVista, Inc. A security vulnerability exists in SmartVista SVFE2 version v2.2.22, which originates from an SQL injection that can be achieved by an attacker via the voiceAudit:jid97 parameter of the /SVFE2/pages/audit/voiceaudit.jsf component...
Rounding errors can lead to wrong voting power
Lines of code Vulnerability details Impact The calculation of voting power in Crowdfund.getFinalContribution can lead to loss of voting power due to rounding errors. Tools Used Manual audit --- The text was updated successfully, but these errors were encountered: All reactions...
KubeVirt vulnerable to arbitrary file read on host
As part of a Kubevirt audit performed by NCC group, a finding dealing with systemic lack of path sanitization which leads to a path traversal was identified. Google tested the exploitability of the paths in the audit report and identified that when combined with another vulnerability one of the...
CVE-2022-31861
Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...
CVE-2022-31861
Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...
Cross site scripting
Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...
CVE-2022-31861
Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...
CVE-2022-31861
Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...
ThingsBoard IoT Platform 跨站脚本漏洞
ThingsBoard IoT Platform is an open source IoT platform for data collection, processing, visualization and device management from ThingsBoard, Inc. A security vulnerability exists in ThingsBoard IoT Platform versions 3.3.4.1 and earlier, which stems from the presence of cross-site scripting XSS v...
PT-2022-20962 · Unknown · Thingsboard Iot Platform
Name of the Vulnerable Software and Affected Versions: ThingsBoard IoT Platform versions prior to 3.3.4.1 Description: The issue is related to Cross Site Scripting XSS in the ThingsBoard IoT Platform. It occurs when a crafted value is sent to the audit logs, potentially allowing malicious actions...
Potential DoS in _claim()
Lines of code Vulnerability details Impact An attacker could call claim in an infinite loop to conduct DoS attack. Proof of Concept Here is the implementation of claim: // User provides the the cToken & the amount they should get, and it is verified against the merkle root for that cToken ///...
MAL-2022-4 Malicious code in --no-audit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 649eb0d2d0ee5a8de3b866728e219596fac64a483a2e2896498457b7fa0a844f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in --no-audit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 649eb0d2d0ee5a8de3b866728e219596fac64a483a2e2896498457b7fa0a844f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins
Grafana Labs reports: On September 7th as a result of an internal security audit we have discovered that Grafana could leak the authentication cookie of users to plugins. After further analysis the vulnerability impacts data source and plugin proxy endpoints under certain conditions. We believe...