CVE-2023-39380

Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio devices to perform abnormally...

MAL-2023-1437 Malicious code in eslint-plugin-ironfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ddb571e2a90d22e958b983fe2578c4dc66915310367953568399aa68773cc77a The OpenSSF Package Analysis project identified 'eslint-plugin-ironfish' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

electionToTimestamp() might return incorrect timestamps depending on the day of the first election

Lines of code Vulnerability details Bug Description For nominee elections, election dates are determined using the the electionToTimestamp function in the SecurityCouncilNomineeElectionGovernorTiming module. When SecurityCouncilNomineeElectionGovernor is initialized after deployment, the first...

MAL-2023-1218 Malicious code in jest-cucumber-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e2fbf023b3a861ceda4ee89f2c188d2cf7e1b274a07fb7f0df58b9d86c6935b2 The OpenSSF Package Analysis project identified 'jest-cucumber-reporter' @ 0.0.9 npm as malicious. It is considered malicious because: - The...

Design/Logic Flaw

A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969...

CVE-2023-36923

SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library, that can be executed by the application. An attacker could thereby control the behavior of the application...

getTickAtSqrtRatio used in TokenisableRange.sol to calculate lower and upper ticks is used without letting for overflow behavior, which is required

Lines of code Vulnerability details Impact The function getTickAtSqrtRatio is used multiple times in the TokenisableRange.sol, but the library TickMath.sol is compiled with pragma solidity ^0.8.4 as you can see here which doesn't allow for overflows, and since the function is not unchecked,...

Missing sanityCheckUnderlying Call in Certain Functions of OptionsPositionManager Contract

Lines of code Vulnerability details Bug Description In the OptionsPositionManager contract, there is a missing call to the sanityCheckUnderlying function at the beginning of the sellOptions and close functions. These functions involve interactions with option assets and underlying tokens. However...

Malicious code in my-fallen-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7c1f73f0c85f62e81e5bb2b99f08089c34ecaa76487bac79f482b75c131ef13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Miusing empty string insteaf of oracleData in updateExchangeRate

Lines of code Vulnerability details Impact contract has this storage: /// @notice oracleData bytes public oracleData; updated, rate = oracle.get""; Instead of oracle.get"", it should use proper oracle data which was set otherwise it can lead to undefined behavior where oracle expects data. Proof ...

MAL-2023-1263 Malicious code in papaya_pear_vicious (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 080555e8b0e713640ab3072d60fca6f3144f3738c13d3b46d93e89ebf87d0a15 The OpenSSF Package Analysis project identified 'papayapearvicious' @ 3.0.0 npm as malicious. It is considered malicious because: - The package...

GHSA-5R98-F33J-G8H7 pnpm incorrectly parses tar archives relative to specification

Summary It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. Details The TAR format is an append-only archive format, and as such, the specification for how to update a...

New P2PInfect Worm Targets Redis Servers with Undocumented Breach Methods

The P2PInfect peer-to-peer P2 worm has been observed employing previously undocumented initial access methods to breach susceptible Redis servers and rope them into a botnet. "The malware compromises exposed instances of the Redis data store by exploiting the replication feature," Cado Security...

SolarWinds Platform 2023.2.0 < 2023.3 Multiple Vulnerabilities

The version of SolarWinds Platform installed on the remote host is prior to 2023.3. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwindsplatform20233 advisory. - Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to...

CVE-2023-33224

The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges...

CVE-2023-33224 SolarWinds Platform Incorrect Behavior Order Vulnerability

The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges...

CVE-2023-33224

The CVE-2023-33224 entry concerns the SolarWinds Platform (SolarWinds Orion Platform) and describes an Incorrect Behavior Order Vulnerability. The issue allows users with administrative access to the SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges, due to an i...

Important: golang

Issue Overview: html/template: improper handling of empty HTML attributes. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains...

GHSA-F5X6-7QGP-JHF3 ecrecover can return undefined data if signature does not verify

Impact the ecrecover precompile does not fill the output buffer if the signature does not verify, see https://github.com/ethereum/go-ethereum/blob/b058cf454b3bdc7e770e2b3cec83a0bcb48f55ee/core/vm/contracts.goL188. however, the ecrecover builtin will still return whatever is at memory location 0...

ecrecover can return undefined data if signature does not verify

Impact the ecrecover precompile does not fill the output buffer if the signature does not verify, see https://github.com/ethereum/go-ethereum/blob/b058cf454b3bdc7e770e2b3cec83a0bcb48f55ee/core/vm/contracts.goL188. however, the ecrecover builtin will still return whatever is at memory location 0...