269 matches found
CVE-2024-55907 IBM Cognos Mobile information disclosure
IBM Cognos Analytics Mobile 1.1 for iOS application could allow an attacker to reverse engineer the codebase to gain knowledge about the programming technique, interface, class definitions, algorithms and functions used due to weak obfuscation...
Java-springboot-codebase 代码问题漏洞
Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects from osama individual developers. A code issue vulnerability exists in Java-springboot-codebase that stems from allowing files to be uploaded without proper authentication or restrictions...
CycloneDX cdxgen may execute code contained within build-related files
CycloneDX cdxgen prior to 11.1.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...
CVE-2024-50611
CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...
Evmos vulnerable to exploit of smart contract account and vesting
Summary This advisory board aims to describe two vulnerabilities found in the Evmos codebase: - Authorization check on the fundVestingAccount: unauthorized spend of funds. Details Authorization check on the fundVestingAccount With the current implementation, a user can create a vesting account wi...
Spring Tips: Introducing Spring Modulith
Hi, Spring fans! In this installment we look at the amazing Spring Modulith project. It's goal is to help you better structure your codebase for architectural scalability. It's an amazing and refreshing approach to building applications. Think of it like a chance to pair program on the architectu...
stormpath/sdk uses Insecure Random Number Generator
The vulnerability pertains to the usage of an insecure random number generator RNG in the "stormpath-sdk-php" library. Specifically, the issue is present in the generation of UUID Universally Unique Identifier version 4 within the codebase...
BIT-MODSECURITY2-2022-48279
In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity C language codebase...
CVE-2023-52323
PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack...
Underflow can be occurred in codebase
Lines of code Vulnerability details Impact Because of the lack of the input validation, underflow can be occurred in the code. Proof of Concept function getRegisteredBorrowers uint256 start, uint256 end external view returns address memory arr uint256 len = borrowers.length; end = MathUtils.minen...
Many issues around addGlobalToken due to lack of input validation when linking a global token to local token
Lines of code Vulnerability details Impact addGlobalToken is used to add a global token to a branch. The flow as follows: 1 = CoreBranchRouter.addGlobalToken 2 = Send Cross-Chain request System Response/Request with FuncId 0x01 Notice that is uses normal callOut though. Anyway, let's continue...
cvxPerVotium() calculation will return zero if all CVX tokens are pending withdrawal as obligations
Lines of code Vulnerability details Summary The implementation of cvxPerVotium contains an edge case that causes it to return an invalid zero value price. Impact The cvxPerVotium function present in the VotingStrategy contract is used to measure the number of held CVX tokens per vAfEth. 144:...
CVE-2021-29390
libjpeg-turbo version 2.0.90 has a heap-based buffer over-read 2 bytes in decompresssmoothdata in jdcoefct.c...
the mint function in erc4626 will mint incorrect amount
Lines of code Vulnerability details Impact if you look at the ERC4626 contract the function mint minting the wrong amount at line 53 it should be minting the assets amount not the amount of the share and because the shares and assets are not 1:1 it will lead to unwanted results and different mint...
CVE-2023-36817
In CVE-2023-36817, the repository tktchurch/website (The King’s Temple Church website) version 0.1.0 exposed a Stripe API key in public code. The root cause is sensitive credentials accidentally committed to the codebase, enabling potential unauthorized financial transactions and access to custom...
CVE-2023-36817 The King's Temple Church website Leaked Stripe API Key in Public Code Repository
tktchurch/website contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of the church's project. This sensitive information was unintentionally committed and subsequently exposed in the codebase. If an unauthorized...
Amazon Linux AMI : mod24_security (ALAS-2023-1772)
The version of mod24security installed on the remote host is prior to 2.8.0-5.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1772 advisory. In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web...
This Week in Spring - June 6th, 2023
Hi, Spring fans! Welcome to another installment of This Week in Spring! And what an insane week it's been! Long story short, I've spent 10-12 hours a day over the last five days migrating a dozen differnet applications and services from one GKE cluster to another, taking the time to update things...
[SECURITY] Fedora 37 Update: python-starlette-0.20.4-3.fc37
Starlette is a lightweight ASGI framework/toolkit, which is ideal for building async web services in Python. It is production-ready, and gives you the following: =EF=BF=BD=EF=BF=BD=EF=BF=BD A lightweight, low-complexity HTTP web framewor k. =EF=BF=BD=EF=BF=BD=EF=BF=BD WebSocket support...