10291 matches found
Getting NFT could exceed block size limit
Handle Sherlock Vulnerability details Impact On line 239 it loops over all the NFTs stored in the contract. Although a return statement is included it can cause the transaction to run out of gas in case of an extreme amount of NFTs. Proof of Concept N/A Tools Used Hardhat Recommended Mitigation...
Removing NFT could exceed block size limit
Handle Sherlock Vulnerability details Impact On line 129 it loops over all the NFTs stored in the contract. Although a break statement is included it can cause the transaction to run out of gas in case of an extreme amount of NFTs Proof of Concept N/A Tools Used Hardhat Recommended Mitigation Ste...
timelockERC721Keys could exceed the block size limit
Handle Sherlock Vulnerability details Impact On line 504 of Visor.sol, looping through the timelockERC721Keys could exceed the block size limit Proof of Concept N/A Tools Used Hardhat Recommended Mitigation Steps Transfer by index instead of token ID --- The text was updated successfully, but the...
Unbounded loops
Handle paulius.eth Vulnerability details Impact Unbounded for loops may exceed gas limit. There are several places where iterations over dynamically sized arrays take place. For example, function removeNft iterates over all the NFTs and tries to find the one that is needed to be removed. However,...
Unbounded for-loop bricks transferERC721()
Handle toastedsteaksandwich Vulnerability details Impact The nfts array in the Visor contract could become overpopulated, causing certain functions that loop over it to brick, due to the gas limit. These functions include transferERC721 and getNftIdByTokenIdAndAddr. The severity of this issue is...
Code injection
Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog...
CVE-2021-24194 Login Protection - Limit Failed Login Attempts < 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog...
CVE-2021-24194: Improper Authorization
Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog...
Denial of service
Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all...
CVE-2021-22139
Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all...
Sifchain: No Rate Limit protection in user subscription form
Summary: Hello I found your form that user can subscribe for any update has no rate limit protection. Step to reproduce 1. Visit http://sifchain.finance and move to subscribe form and enter email 2. click on sign-up button. 3. use burpsuite to intercept the request and send to intruder. 4. Clear...
USN-4948-1 linux-oem-5.10 vulnerabilities
Ryota Shiga discovered that the eBPF implementation in the Linux kernel did not properly verify that a BPF program only reserved as much memory for a ring buffer as was allocated. A local attacker could use this to cause a denial of service system crash or execute arbitrary code. CVE-2021-3489...
Description of the security update for SharePoint Server 2019: May 11, 2021 (KB5001916)
None None...
Unbounded iteration in NFTXEligiblityManager.distribute over _feeReceivers
Handle @cmichelio Vulnerability details Vulnerability Details NFTXEligiblityManager.distribute iterates over all feeReceivers. Impact If the number of feeReceivers gets too big, the transaction's gas cost could exceed the block gas limit and make it impossible to call distribute at all. Recommend...
Unbreakable Enterprise kernel-container security update
4.14.35-2047.503.1.el7 - bpf, x86: Validate computation of branch displacements for x86-64 Piotr Krysiuk Orabug: 32759961 CVE-2021-29154 - uek-rpm: Add Amazon Elastic Network Adapter module to nano rpm. Somasundaram Krishnasamy Orabug: 32781585 - ext4: handle error of ext4setupsystemzone on remou...
PT-2024-11089 · Linux +1 · Linux Kernel +1
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue arises from the Linux kernel's handling of Power Data Objects PDOs when connected to a PD-capable source. The kernel only receives the first 4 PDOs due to the MESSAGE IN leng...
PYSEC-2021-12
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to...
Design/Logic Flaw
SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the filesystem.renamer function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as part of SABnzbd 3.2.1RC1. As a workaround,...
Improper Privilege Management in monicahq/monica
✍️ Description Bypass payment verification and add more contact. From free account user can add only 10 contacts . but using this bug user can add more than 10 contacts for free 🕵️♂️ Proof of Concept 1. First goto https://app.monicahq.com/people from free account and add 10 contacts . Now you cant...
