CVE-2021-37376

Teradek Bond family (Bond, Bond 2, Bond Pro) firmware 7.3.x and earlier is affected by a Cross Site Scripting (XSS) issue in the Friendly Name field of System Information Settings that could allow remote code execution. Root cause details are not provided beyond the vulnerable field, and multiple...

PT-2023-33502 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 6.0.16 through 6.0.18 Description: The issue is related to a lockdep splat in the bond miimon commit function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel version...

The vulnerability of the command-line interface of microprogramming software for Cisco SD-WAN vBond Orchestrator, Cisco SD-WAN vEdge Cloud Routers, Cisco SD-WAN vEdge Routers, Cisco SD-WAN vSmart Controller, and the centralized network management system Cisco SD-WAN vManage arises from incorrect path name restrictions related to restricted access directories. This vulnerability allows attackers to create or re-record critical files.

The vulnerability of the command-line interface of microprogramming software for Cisco SD-WAN vBond Orchestrator, Cisco SD-WAN vEdge Cloud Routers, Cisco SD-WAN vEdge Routers, Cisco SD-WAN vSmart Controller, and the centralized network management system Cisco SD-WAN vManage is related to an...

LP Rewards can be increased infinitely by a malicious liquidity provider

Lines of code Vulnerability details Impact LP Rewards can be increased infinitely by a malicious liquidity provider Proof of Concept A Bond NFT holder can claim pending rewards from a bond using the function Lock.claim. function claim uint256 id public returns address claimGovFees; uint amount,...

Upgraded Q -> M from 300 [1668888076013]

Judge has assessed an item in Issue 300 as Medium risk. The relevant finding follows: L-03 Full minimal bond amount is slashed, instead of a percentage - Duplicate of 307 --- The text was updated successfully, but these errors were encountered: All reactions...

PT-2025-18580

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is caused by a NULL pointer dereference in the can rx register function when testing the following scenario: a creating a netlink socket using syscall NR socket, 0x10ul, 3ul, 0...

MEV: Operator can bribe miner and steal honest operator's bond amount if gas price went high

Lines of code Vulnerability details Description Operators in Holograph do their job by calling executeJob with the bridged in bytes from source chain. If the primary job operator did not execute the job during his allocated block slot, he is punished by taking a single bond amount and transfer it...

An attacker can lock operator out of the pod by setting gas limit that's higher than the block gas limit of dest chain

Lines of code Vulnerability details When a beaming job is executed, there's a requirement that the gas left would be at least as the gasLimit set by the user. Given that there's no limit on the gasLimit the user can set, a user can set the gasLimit to amount that's higher than the block gas limit...

UBUNTU-CVE-2022-3624

A vulnerability was found in Linux Kernel and classified as problematic. Affected by this issue is the function rlbarpxmit of the file drivers/net/bonding/bondalb.c of the component IPsec. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier ...

_getPriceDecimals() can return wrong decimal

Lines of code Vulnerability details Impact The decimal returned from function getPriceDecimals is used in function activate to create bond market. If the decimal is not accurate, the price for bond can be wrong, could result in: too low price: abnormal arbitrage opportunity and fund loss to the...

Cushion bond markets are opened at wall price rather than current price

Lines of code Vulnerability details Impact Incorrect initial bond market price Proof of Concept uint256 initialPrice = range.wall.high.price.mulDivbondScale, oracleScale; uint256 initialPrice = invWallPrice.mulDivbondScale, oracleScale; In the above lines the initial prices are set to the wall...

GHSA-RQRC-8Q8F-CP9C Infinite loop in .Net Bond

A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'. Handling of large container lengths that could cause an infinite loop when deserializing some payloads...

Infinite loop in .Net Bond

A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'. Handling of large container lengths that could cause an infinite loop when deserializing some payloads...

Unrestricted Upload of File with Dangerous Type

A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'...

GSD-2022-1000638 net/mlx5e: Fix handling of wrong devices during bond netevent

net/mlx5e: Fix handling of wrong devices during bond netevent This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.6 by commit...

Spam and phishing in 2021

Figures of the year In 2021: 45.56% of e-mails were spam 24.77% of spam was sent from Russia with another 14.12% from Germany Our Mail Anti-Virus blocked 148 173 261 malicious attachments sent in e-mails The most common malware family found in attachments were Agensla Trojans Our Anti-Phishing...

UBUNTU-CVE-2022-0286

A flaw was found in the Linux kernel. A null pointer dereference in bondipsecaddsa may lead to local denial of service...

SherlockClaimManager: Incorrect amounts needed and paid for escalated claims

Handle GreyArt Vulnerability details Impact When escalating claims, the documentation states that the protocol agent is required to pay and stake a certain amount for the process. If the covered protocol is proven correct, then the amount specified by the claim will be paid out. They will also...

Basket.sol#publishNewIndex() Lack of input validation may cause fund loss to anyone who bonds an auction

Handle WatchPug Vulnerability details According to the newRatio formula in settleAuction, the maximum value of newRatio is factory.auctionMultiplier basket.ibRatio. However, since there is no validation for the value of minIbRatio when setting it, if the publisher publishes a newIndex with...

Publisher can lock all user funds in the Basket in order to force a user to have their bond burned

Handle TomFrenchBlockchain Vulnerability details Impact All user funds in a basket being held hostage by the publisher Proof of Concept The Basket publisher can propose an auction in order to set new tokens and weights with a 1 day timelock. As part of this call they can set the minIbRatio variab...