PT-2023-25174 · Vega · Vega

Name of the Vulnerable Software and Affected Versions: Vega versions prior to 0.71.6 Description: A vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events from Vega’s Ethereum bridge. For example, a deposit to the collateral bridge...

Improper Input Validation

Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to version 0.71.6, a vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events from Vega’s Ethereum bridge. For exampl...

MAL-2023-719 Malicious code in rainbow-bridge-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9d5b776bcc096bf2074b398b85698a12e8607fa2a06624cf23130a12eea6093 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-6089 · Adobe · Bridge

Name of the Vulnerable Software and Affected Versions: Adobe Bridge versions 12.0.4 and earlier Adobe Bridge versions 13.0.3 and earlier Description: The issue is related to a Use After Free vulnerability in Adobe Bridge, specifically when handling embedded fonts. This could lead to the disclosur...

ERC20 token bridge does not support token with different decimals

Lines of code Vulnerability details ERC20 token bridge does not support token with different decimals Summary ERC20 token bridge does not support token with different decimals Vulnerability Detail In the current implementation: User can perform ERC20 cross-chain transfer via token bridge. Let us...

Technically the seven days period is not guaranteed and it's possible for the challenger to delete a withdrawal even if it hasn't been challenged during the seven days

Lines of code Vulnerability details Proof of Concept There's an existing logic to prevent the CHALLENGER from deleting a l2Output after the finalization period has ended. This is done to prevent having user withdrawals blocked after the finalization period has elapsed without challenges. The...

Loss of airdropped Token or NFT in NFT Bridge

Lines of code Vulnerability details Impact Loss of airdropped Token or NFT in NFT Bridge and Token Bridge Proof of Concept Contract L1ERC721Bridge is for bridging NFTs from L1 to L2 and it holds all the bridged NFTs. Most of the NFT projects would airdrop new NFTs for previous owners or drop ERC2...

The vulnerability of the Siveillance Video Open Network Bridge software for IP video surveillance systems allows a intruder to decode all the credentials stored on the ONVIF server.

The vulnerability of the Siveillance Video Open Network Bridge software management system for IP-camera surveillance is related to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability could allow an attacker, operating remotely, to decrypt all the credentials stored on...

Risk assessment of the finalizeETHWithdrawal function in the bridge contract

Lines of code Vulnerability details Summary The finalizeBridgeETH function: function finalizeETHWithdrawal address from, address to, uint256 amount, bytes calldata extraData external payable finalizeBridgeETHfrom, to, amount, extraData; is a public function, which means that anyone can call it...

CVE-2023-23578

Improper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier allows a remote unauthenticated attacker to connect to the product's ADB port...

PT-2023-8236 · Google · Google Chrome

Name of the Vulnerable Software and Affected Versions: Google Chrome on ChromeOS versions prior to 114.0.5735.90 Description: The issue is related to insufficient policy enforcement in the Android Debug Bridge ADB component of Google Chrome on ChromeOS. This allows a local attacker with physical...

CVE-2023-31444

In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice. This allows for remote access to the JVM via the Jolokia JMX-HTTP bridge...

CVE-2023-31444

CVE-2023-31444 – Talend Studio Jolokia exposure : Affects Talend Studio versions before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09. The issue is an unauthenticated access vulnerability to the Jolokia endpoint of Talend microservices, enabling remote JVM access via the Jolokia JMX-HTTP bridge. T...

MAL-2023-1214 Malicious code in inter-mobile-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7202781ee0df940e4433cfd643ce8bca065164302e9a8ae33e2cda7590a6bdb6 The OpenSSF Package Analysis project identified 'inter-mobile-bridge' @ 1.0.8 npm as malicious. It is considered malicious because: - The packag...

DEBIAN-CVE-2023-31081

An issue was discovered in drivers/media/test-drivers/vidtv/vidtvbridge.c in the Linux kernel 6.2. There is a NULL pointer dereference in vidtvmuxstopthread. In vidtvstopstreaming, after dvb-mux=NULL occurs, it executes vidtvmuxstopthreaddvb-mux...

Security Bulletin: IBM MQ Blockchain bridge is vulnerable to an issue identified in snakeyaml (CVE-2022-41854)

Summary An issue was identified with the snakeyaml package that is used by the fabric gateway package that is used by the IBM MQ Blockchain bridge package to provide Blockchain functionality in IBM MQ. Vulnerability Details CVEID:CVE-2022-41854 DESCRIPTION: snakeYAML is vulnerable to a denial of...

CVE-2023-27267

Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely...

CVE-2023-27267

Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely...

Input validation

Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely...

CVE-2023-27267 Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge)

Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely...