Microsoft Security Update Validation Report December 2021

Microsoft’s December 2021 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English only environments and issues may still be found upon implementation. Follow best practices for testing and installing softwa...

ModelSim Simulation and Questa Simulation Underprotected Credential Vulnerability

Questa and ModelSim simulators are used worldwide to simulate, debug, and verify integrated circuit designs, etc. ModelSim Simulation and Questa Simulation do not protect sufficient credentials, and the RSA white-box implementation in the affected application does not adequately protect the...

ALBA-2021:5146 .NET 5.0 bugfix update

.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. Bug Fixes and Enhancements: Update .NET 5.0 to SDK 5.0.210 and Runtime 5.0.13 almalinux-8.5.0.z BZ2030738...

.NET 5.0 bugfix update

.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. Bug Fixes and Enhancements: Update .NET 5.0 to SDK 5.0.210 and Runtime 5.0.13 almalinux-8.5.0.z BZ2030738...

Wrong implementation of AaveYield.sol causing users to lose yields

Handle WatchPug Vulnerability details The current implementation of AaveYield.sol is taking AAVE aToken as a share token eg, cToken and yToken. However, AAVE's aTokens are quite different from cToken and yToken as it's always 1:1 to the underlying token, and the holder's balance will keep changin...

Wrong implementation of NoYield.sol#emergencyWithdraw()

Handle WatchPug Vulnerability details function emergencyWithdrawaddress asset, address payable wallet external onlyOwner returns uint256 received requirewallet != address0, 'cant burn'; uint256 amount = IERC20asset.balanceOfaddressthis; IERC20asset.safeTransferwallet, received; received = amount;...

Information Disclosure

bluez is vulnerable to information disclosure. The vulnerability exists due to the handling of a SVCATTRREQ by the SDP implementation which allows an attacker to inject a malicious CSTATE, tricking the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary...

CVE-2021-42023

A vulnerability has been identified in ModelSim Simulation All versions, Questa Simulation All versions. The RSA white-box implementation in affected applications insufficiently protects the built-in private keys that are required to decrypt electronic intellectual property IP data in accordance...

Design/Logic Flaw

A vulnerability has been identified in ModelSim Simulation All versions, Questa Simulation All versions. The RSA white-box implementation in affected applications insufficiently protects the built-in private keys that are required to decrypt electronic intellectual property IP data in accordance...

[SECURITY] Fedora 34 Update: python-markdown2-2.4.2-1.fc34

Markdown is a text-to-HTML filter; it translates an easy-to-read / easy-to-write structured text format into HTML. Markdown's text format is most similar to that of plain text email, and supports features such as headers, emphasis, code blocks, blockquotes, and links. This is a fast and complete...

CVE-2021-42023

A vulnerability has been identified in ModelSim Simulation All versions, Questa Simulation All versions. The RSA white-box implementation in affected applications insufficiently protects the built-in private keys that are required to decrypt electronic intellectual property IP data in accordance...

CVE-2021-42023

The CVE-2021-42023 entry covers Siemens ModelSim Simulation and Questa Simulation (all versions) where the RSA white-box implementation does not sufficiently protect built‑in private keys used to decrypt IP data per IEEE 1735. The underlying issue is insufficiently protected credentials (CWE-522)...

CVE-2021-41272

CVE-2021-41272 affects the Besu Ethereum client (Java). Beginning with 21.10.0, changes to SHL/SHR/SAR caused a signed type coercion error for negative values in 32-bit integers. Consequence: on networks with mixed vulnerable/non‑vulnerable miners, forks may occur and affected transactions may be...

[SECURITY] Fedora 35 Update: python-markdown2-2.4.2-1.fc35

Markdown is a text-to-HTML filter; it translates an easy-to-read / easy-to-write structured text format into HTML. Markdown's text format is most similar to that of plain text email, and supports features such as headers, emphasis, code blocks, blockquotes, and links. This is a fast and complete...

Inappropriate Implementation

qt5-qtwebengine is vulnerable to inappropriate implementation. The vulnerability exists due to a security issue that was found in the referrer component of the Chromium browser engine...

Insecure Implementation In WebAuthentication

qt5-qtwebengine has inappropriate implementation in WebAuthentication...

Business Logic Flaws

qt5-qtwebengine is vulnerable to business logic flaws. The vulnerability exists due to an inappropriate implementation flaw was found in the navigation component of the Chromium browser...

Privilege Escalation

qt5-qtwebengine is vulnerable to privilege escalation. The vulnerability exists due to an inappropriate implementation security issue has been found in the input component of the Chromium browser engine...

getRewardsAmount doesn't check epochs haven't been claimed

Handle harleythedog Vulnerability details Impact In ITwabRewards.sol, it is claimed that getRewardsAmount should account for epochs that have already been claimed, and not include these epochs in the total amount indeed, there is a line that says @dev Will be 0 if user has already claimed rewards...

GHSA-7PRF-VW4P-QR59 Prototype pollution in supermixer

Prototype pollution in Stampit supermixer allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation...