8330 matches found
DAO functions can be called before initialization in init() of DAO.sol
Handle 0xRajeev Vulnerability details Impact All the external/public functions of DAO.sol can be called by other contracts even before DAO.sol contract is initialized. This can lead to exceptions, state corruption or incorrect accounting in other contracts, which may require redeployment of...
Incorrect operator used in deploySynth() of Pools.sol
Handle 0xRajeev Vulnerability details Impact The deploySynth function in Pools.sol is expected to perform a check on the token parameter to determine that it is neither VADER or USDV before calling Factory’s deploySynth function. However, the require incorrectly uses ‘||’ operator instead of ‘&&’...
Initialization can be front-run in DAO.sol
Handle 0xRajeev Vulnerability details Impact Given the public access, this is susceptible to front-running by an attacker who can initialize this with arbitrary assets before the deployer. Reinitialization will require contract redeployment because initialization can be done only once. Reference:...
Code injection
HedgeDoc formerly known as CodiMD is an open-source collaborative markdown editor. An attacker is able to receive arbitrary files from the file system when exporting a note to PDF. Since the code injection has to take place as note content, there fore this exploit requires the attackers ability t...
CVE-2021-29475
CVE-2021-29475 affects HedgeDoc (formerly CodiMD). The vulnerability allows an attacker who can modify a note to cause the system to export the note to PDF in a way that reads arbitrary files from the server’s filesystem (including config.json and other sensitive data) via file:/// references use...
CVE-2021-0266
The use of multiple hard-coded cryptographic keys in cSRX Series software in Juniper Networks Junos OS allows an attacker to take control of any instance of a cSRX deployment through device management services. This issue affects: Juniper Networks Junos OS on cSRX Series: All versions prior to...
CVE-2021-0232 Paragon Active Assurance: Authentication bypass vulnerability in Control Center
An authentication bypass vulnerability in the Juniper Networks Paragon Active Assurance Control Center may allow an attacker with specific information about the deployment to mimic an already registered Test Agent and access its configuration including associated inventory details. If the issue...
Innovative Ways Customers Compute on the Edge
Moving everything closer to the edge is the key to delivering better, faster experiences to people through billions of devices around the world. The idea of edge computing isn't new -- Akamai customers have been caching content at the edge for decades, taking advantage of lower latency and...
Manage Linux Patching with Qualys VMDR
As attacks on infrastructure continue to increase, security teams are looking to go beyond detection and response by eliminating the root cause of the attacks -- unpatched vulnerabilities. With the majority of production systems running Linux, IT teams have been looking for a single, efficient...
Microsoft Windows AppX Deployment Service Directory Junction Denial-of-Service Vulnerability
This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...
CVE-2021-3506
An out-of-bounds OOB memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this...
SUSE: Security Advisory (SUSE-SU-2018:2839-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-4891-1: OpenSSL vulnerability | Cloud Foundry
Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description It was discovered that OpenSSL incorrectly handled certain renegotiation ClientHello messages. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly...
AWS User Account Permissions for Deployment of Veeam Backup for AWS Appliance
This article documents the granular permissions needed for deploying a new Veeam Backup for AWS appliance...
Microsoft Windows and Windows Server Denial of Service Vulnerability (CNVD-2021-34487)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. A denial of service vulnerability exists in the AppX Deployment Server in Microsoft Window...
USN-4882-1: Ruby vulnerabilities | Cloud Foundry
Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description It was discovered that the Ruby JSON gem incorrectly handled certain JSON files. If a user or automated system were tricked into parsing a specially crafted JSON file, a remote attacker could use this iss...
USN-4764-1: GLib vulnerability | Cloud Foundry
Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that GLib incorrectly handled certain symlinks when replacing files. If a user or automated system were tricked into extracting a specially crafted file with File...
8X8 Docker Jitsi Meet 跨站脚本漏洞
8X8 Docker Jitsi Meet is a tool for building Jitsi Meet videoconferencing solutions in Docker from 8x8 USA. A cross-site scripting vulnerability exists in Jitsi Meet versions 2.7 through 2.8.3, which originates in the sessionprivi .php module...
