64 matches found
PayPal closes loophole that let scammers send real emails with fake purchase notices
After an investigation by BleepingComputer, PayPal closed a loophole that allowed scammers to send emails from the legitimate [email protected] email address. Following reports from people who received emails claiming an automatic payment had been cancelled, BleepingComputer found that...
EUVD-2025-203093
Weaviate OSS has path traversal vulnerability via the Shard Movement API...
CVE-2025-67819
An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files...
CVE-2025-67819
An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files...
CVE-2025-67819
An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files...
CVE-2023-53339
CVE-2023-53339 : In the Linux kernel’s Btrfs code, a race between pausing and balancing can cause a BUG_ON panic in btrfs_cancel_balance due to an unaccounted race. The race has no other side effects, and a fix has been applied in the upstream patch set. The vulnerability affects local attackers ...
PT-2025-38198
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.0-rc2-btrfs-next-127+ Description The Linux kernel contained a deadlock issue within the BTRFS file system related to transaction handling during block group relocation with scrub enabled. Specifically, a...
March 25, 2025—KB5053643 (OS Build 19045.5679) Preview
None None...
InitCore.liquidate will revert in case if poolOut is paused for collateral
Lines of code Vulnerability details Proof of Concept InitCore.liquidate function tries to check, that provided poolOut variable is valid pool of protocol. It does it using vars.config.isAllowedForCollateral check. As you can see, in case if poolOut will be paused as collateral for the mode, then...
interest is still accuring when the market is paused, force user to incur debts
Lines of code Vulnerability details Impact interest is still accuring when the market is paused, force user to incur debts Proof of Concept when the function accure is called the interest is accured after the interest rate is calculated uint256 interestRate = IIRMirm.getInterestRateaddressthis,...
Users can unfollow through FollowNFT contract when LensHub is paused by governance
Lines of code Vulnerability details Bug Description When the LensHub contract has been paused by governance state set to ProtocolState.Paused, users should not be able unfollow profiles. This can be inferred as the unfollow function has the whenNotPaused modifier: LensHub.solL368-L371 function...
PyPI Repository Under Attack: User Sign-Ups and Package Uploads Temporarily Halted
The maintainers of Python Package Index PyPI, the official third-party software repository for the Python programming language, have temporarily disabled the ability for users to sign up and upload new packages until further notice. "The volume of malicious users and malicious projects being...
redeem() should be possible when protocol is Paused but to be able to redeem function grantRTokenAllowance() should be called for any basket tokens and it can only be called when protocol is not paused
Lines of code Vulnerability details Impact Function redeem in RToken contract, redeems RToken for basket collateral and it's callable when protocol is paused. but function redeem transfers basket tokens from BackingManager contract to redeemer and it requires spending allowance of the BackingMang...
IRREVERSIBLE SHUTDOWN FUNCTION
Lines of code Vulnerability details Impact The abstract contract VaultImplementation is inherited by Vault.sol and PublicVault.sol. Its shutdown can be called by the strategist to make loadVISlot.isShutdown = true. This will make the modifier whenNotPaused revert, rendering commitToLien and...
exchangeRateDeltaLimit can be exceeded with overrideExchangeRate() and remain unpaused
Lines of code Vulnerability details Impact The CashManger has a safety feature that limits the maximum change in the exchange rate between epochs. in setMintExchangeRate it is checked that this limit is not exceeded but there is no check in overrideExchangeRate. Proof of Concept An epoch could ha...
Users shouldn't be forced into a specific strategy (possible rug pull)
Handle harleythedog Vulnerability details Impact As already discussed in the previous Sherlock C4 contest here, it is best to mitigate rug pull possibilities even if the team is well intentioned, there is still the risk of being called out, and less users might interact with the project if the...
June 18, 2020—KB4567523 (OS Build 19041.331)
None None...
June 16, 2020—KB4567512 (OS Builds 18362.904 and 18363.904)
None None...