CVE-2022-29220: Unverified Ownership

github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...

PT-2022-19473

Name of the Vulnerable Software and Affected Versions github-action-merge-dependabot versions prior to 3.2.0 Description github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, it does not check if a commit created b...

Approved spender can not withdraw or merge

Lines of code Vulnerability details In the current implementation, withdraw and merge veNFT can be called by approved spender or token owner. function withdrawuint tokenId external nonreentrant assertisApprovedOrOwnermsg.sender, tokenId; function mergeuint from, uint to external...

withdraw() and merge() functions of VotingEscrow won't work when an approved user(not owner) calls because _burn() function fails.

Lines of code Vulnerability details Impact withdraw and merge functions of VotingEscrow won't work when an approved usernot owner calls. Proof of Concept withdraw and merge functions call burn function inside and burn function calls removeTokenFrom using msg.sender. But removeTokenFrom requires...

VotingEscrow's merge and withdraw aren't available for approved users

Lines of code Vulnerability details Users who are approved, but do not own a particular NFT, are supposed to be eligible to call merge and withdraw from the NFT. Currently burn, used by merge and withdraw to remove the NFT from the system, will revert unless the sender is the owner of NFT as the...

Learn How Hackers Can Hijack Your Online Accounts Even Before You Create Them

Malicious actors can gain unauthorized access to users' online accounts via a new technique called "account pre-hijacking," latest research has found. The attack takes aim at the account creation process that's ubiquitous in websites and other online platforms, enabling an adversary to perform a...

com.switchfly:gitlab-merge-request-jenkins (2.0.0), org.jenkins-ci.main:jenkins-test-harness (1.638) +4 more potentially affected by CVE-2021-21691 via org.jenkins-ci.main:jenkins-core (1.638)

org.jenkins-ci.main:jenkins-core MAVEN version 1.638 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 2.0.0 - org.jenkins-ci.main:jenkins-test-harness 1.6...

com.switchfly:gitlab-merge-request-jenkins (1.2.2), org.jenkins-ci.main:jenkins-test-harness (1.563) +2 more potentially affected by CVE-2021-21691 via org.jenkins-ci.main:jenkins-core (1.563)

org.jenkins-ci.main:jenkins-core MAVEN version 1.563 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 1.2.2 - org.jenkins-ci.main:jenkins-test-harness 1.5...

org.jenkins-ci.plugins:assembla-merge-request-builder (>=1.1.1, <=1.1.13), org.jenkins-ci.plugins:bitbucket-pullrequest-builder (>=1.4.6, <=1.4.28) +2 more potentially affected by CVE-2021-21684 via org.jenkins-ci.plugins:git (2.2.4)

org.jenkins-ci.plugins:git MAVEN version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:assembla-merge-request-builder =1.1.1, =1.4.6, =1.13-1, =1.1.1, =1.4.2 Source cves:...

com.switchfly:gitlab-merge-request-jenkins (1.2.2), org.jenkins-ci.main:jenkins-test-harness (1.563) +2 more potentially affected by CVE-2021-21671 via org.jenkins-ci.main:jenkins-core (1.563)

org.jenkins-ci.main:jenkins-core MAVEN version 1.563 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 1.2.2 - org.jenkins-ci.main:jenkins-test-harness 1.5...

com.switchfly:gitlab-merge-request-jenkins (1.2.2), org.jenkins-ci.main:jenkins-test-harness (1.563) +2 more potentially affected by CVE-2021-21640 via org.jenkins-ci.main:jenkins-core (1.563)

org.jenkins-ci.main:jenkins-core MAVEN version 1.563 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 1.2.2 - org.jenkins-ci.main:jenkins-test-harness 1.5...

com.switchfly:gitlab-merge-request-jenkins (2.0.0), org.jenkins-ci.main:jenkins-test-harness (1.638) +4 more potentially affected by CVE-2021-21615 via org.jenkins-ci.main:jenkins-core (1.638)

org.jenkins-ci.main:jenkins-core MAVEN version 1.638 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 2.0.0 - org.jenkins-ci.main:jenkins-test-harness 1.6...

com.cloudbees.jenkins.plugins:custom-tools-plugin (>=0.3, <=0.4.4), com.datical.integration.jenkins:datical-db-plugin (>=1.0.3, <=1.0.35) +47 more potentially affected by CVE-2021-21605 via org.jenkins-ci.main:jenkins-core (1.480.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.480.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:custom-tools-plugin =0.3, =1.0.3, =1.0.0, =0.1, =0.1, =0.1.0,...

com.switchfly:gitlab-merge-request-jenkins (1.2.2), org.jenkins-ci.main:jenkins-test-harness (1.563) +2 more potentially affected by CVE-2020-2223 via org.jenkins-ci.main:jenkins-core (1.563)

org.jenkins-ci.main:jenkins-core MAVEN version 1.563 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 1.2.2 - org.jenkins-ci.main:jenkins-test-harness 1.5...

com.switchfly:gitlab-merge-request-jenkins (1.2.2), org.jenkins-ci.main:jenkins-test-harness (1.563) +2 more potentially affected by CVE-2020-2221 via org.jenkins-ci.main:jenkins-core (1.563)

org.jenkins-ci.main:jenkins-core MAVEN version 1.563 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 1.2.2 - org.jenkins-ci.main:jenkins-test-harness 1.5...

org.jenkins-ci.plugins:assembla-merge-request-builder (>=1.1.1, <=1.1.13), org.jenkins-ci.plugins:bitbucket-pullrequest-builder (>=1.4.6, <=1.4.28) +2 more potentially affected by CVE-2020-2136 via org.jenkins-ci.plugins:git (2.2.4)

org.jenkins-ci.plugins:git MAVEN version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:assembla-merge-request-builder =1.1.1, =1.4.6, =1.13-1, =1.1.1, =1.4.2 Source cves:...

com.switchfly:gitlab-merge-request-jenkins (1.2.2), org.jenkins-ci.main:jenkins-test-harness (1.563) +2 more potentially affected by CVE-2020-2105 via org.jenkins-ci.main:jenkins-core (1.563)

org.jenkins-ci.main:jenkins-core MAVEN version 1.563 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 1.2.2 - org.jenkins-ci.main:jenkins-test-harness 1.5...

com.amazonaws:codedeploy (>=1.3, <=1.11), com.sonyericsson.hudson.plugins.multi-slave-config-plugin:multi-slave-config-plugin (>=1.1.0, <=1.2.0) +18 more potentially affected by CVE-2020-2100 via org.jenkins-ci.main:jenkins-core (1.554)

org.jenkins-ci.main:jenkins-core MAVEN version 1.554 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.amazonaws:codedeploy =1.3, =1.1.0, =1.2.3, =1.1.0, =1.0, =1.0, =1.0, =2.0.4, =1.10, =1.15,...

com.switchfly:gitlab-merge-request-jenkins (1.2.2), org.jenkins-ci.main:jenkins-test-harness (1.563) +2 more potentially affected by CVE-2020-2102 via org.jenkins-ci.main:jenkins-core (1.563)

org.jenkins-ci.main:jenkins-core MAVEN version 1.563 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 1.2.2 - org.jenkins-ci.main:jenkins-test-harness 1.5...

com.cloudbees.jenkins.plugins:custom-tools-plugin (>=0.3, <=0.4.4), com.datical.integration.jenkins:datical-db-plugin (>=1.0.3, <=1.0.35) +47 more potentially affected by CVE-2020-2104 via org.jenkins-ci.main:jenkins-core (1.480.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.480.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:custom-tools-plugin =0.3, =1.0.3, =1.0.0, =0.1, =0.1, =0.1.0,...