CVE-2024-37154 Evmos allows unvested token delegations

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via ClawbackVestingAccount. This affects 18.1.0 and earlier...

CVE-2024-37154 Evmos allows unvested token delegations

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via ClawbackVestingAccount. This affects 18.1.0 and earlier...

CVE-2024-37153

The CVE-2024-37153 issue affects Evmos (EVM hub on Cosmos). A vulnerability occurs when a local state change happens together with an ICS20 transfer within the same function, using the contract’s address as the sender in an ICS20 precompile transfer. This enables an effective “infinite money glit...

CVE-2024-37153 Evmos's contract balance not updating correctly after interchain transaction

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that...

CVE-2024-32873 evmos allows transferring unvested tokens after delegations

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0...

CVE-2024-32873

CVE-2024-32873 affects Evmos (EVM Hub on Cosmos). The issue: spendable balance is not updated during delegation from clawback vesting accounts, enabling anticipation of unvested tokens release. Root cause involves vesting/delegation logic and vesting/account handling; multiple connected reports d...

CVE-2024-32873 evmos allows transferring unvested tokens after delegations

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0...

CVE-2024-35178

CVE-2024-35178 affects Jupyter Server on Windows, where unauthenticated attackers can leak the NTLMv2 password hash of the Windows user running the server. This can enable cracking the hash to gain access to the host or other networked systems, or allow NTLM relay-style access to additional machi...

CVE-2024-28995

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine...

CVE-2024-28995

CVE-2024-28995 is a directory traversal vulnerability in SolarWinds Serv-U that allows unauthenticated attackers to read sensitive host files. The flaw affects Serv-U and can be triggered via crafted directory/file paths (e.g., using InternalDir/InternalFile payloads) to access local logs and sys...

CVE-2024-28995 SolarWinds Serv-U L Directory Transversal Vulnerability

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine...

PT-2024-4248 · Nvidia +1 · Nvidia Vgpu +1

Name of the Vulnerable Software and Affected Versions: NVIDIA vGPU software for Linux affected versions not specified Description: The issue is related to insufficient control of interaction frequency in the NVIDIA Virtual GPU Manager driver, which can be exploited by an untrusted guest VM to cau...

CVE-2024-28995

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. Recent assessments: sfewer-r7 at June 13, 2024 9:17am UTC reported: Based upon our Rapid7 Analysis, I have rated the attacker value of this vulnerability...

Unpacking 2024's SaaS Threat Predictions

Early in 2024, Wing Security released its State of SaaS Security report, offering surprising insights into emerging threats and best practices in the SaaS domain. Now, halfway through the year, several SaaS threat predictions from the report have already proven accurate. Fortunately, SaaS Securit...

kernel: untrusted VMM can trigger int80 syscall handling

A flaw was found in the Linux kernel. A VMM can inject external interrupts on any arbitrary vector at any time, which may allow the guest OS to be manipulated from the VMM side...

kernel: untrusted VMM can trigger int80 syscall handling

A flaw was found in the Linux kernel. A VMM can inject external interrupts on any arbitrary vector at any time, which may allow the guest OS to be manipulated from the VMM side...

GHSA-8WH2-6QHJ-H7J9 iq80 Snappy out-of-bounds read when uncompressing data, leading to JVM crash

Summary iq80 Snappy performs out-of-bounds read access when uncompressing certain data, which can lead to a JVM crash. Details When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class sun.misc.Unsafe to speed up memory...

SUSE CVE-2019-1002101

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user's machine. If the tar binary in the container is malicious, it could r...

SUSE CVE-2021-26339

A bug in AMD CPU's core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denial of service. AMD believes the specific code includes a specific x86 instruction sequence that would not be generated by compilers...

Malicious code in @juiggitea/dolorem-eius-fuga (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d11af956dfecb2b78e35fcb03a281d3d3d323efff92d5822681014b5ae3377c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...