The vulnerability of the implementation of the ROC protocol for microprogrammed programmable logic controllers FloBoss allows a hacker to execute arbitrary code.

The vulnerability of the ROC protocol implementation in FloBoss microprogrammed logic controllers is related to insecure management of privileges. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Fund migration should trigger a rebase to prevent missing out on potential rewards

Lines of code Vulnerability details Impact Rebasing allows the protocol to "distribute" profit/rewards to Yieldy and Foxy token holders by increasing the supply of tokens and increasing the balance of each token holder relative to the token balance creditBalances. The order of rebasing and...

Protocol can steal WETH founds

Lines of code Vulnerability details Impact The protocol can steal WETH founds with the refunds gas cost mechanism in the functions matchOneToOneOrders, matchOneToManyOrders and matchOrders This functions can call only by the MATCHEXECUTOR but we don't know what is this contract/address according...

Microsoft Lightweight Directory Access Protocol 安全漏洞

Microsoft Lightweight Directory Access Protocol LDAP is a directory services protocol from Microsoft Corporation that runs on a layer above the TCP/IP stack. A security vulnerability exists in Microsoft Lightweight Directory Access Protocol. The following products and editions are affected: Windo...

The vulnerability of the Kerberos protocol for Windows operating systems allows a perpetrator to induce a service failure.

The vulnerability of the Kerberos protocol for Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Protocol unusable for some ERC20 tokens (bad tokens)

Lines of code Vulnerability details Impact Protocol unusable for some ERC20 tokens bad tokens PoC Some tokens don't correctly implement the EIP20 standard and their transfer/transferFrom return void The so called bad tokens. More info This makes the transaction revert when calling. Recommended Us...

CVE-2022-26340

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, an authenticated, high-privileged attacke...

Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal (CVE-2020-25176)

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer IXL protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated...

Microsoft Lightweight Directory Access Protocol输入验证错误漏洞

Microsoft Lightweight Directory Access Protocol LDAP is a directory services protocol from Microsoft Corporation USA that operates on a layer above the TCP/IP stack. An input validation error vulnerability exists in Microsoft Lightweight Directory Access Protocol LDAP. The following products and...

The vulnerability of the implementation of the IPv6 protocol in the Trace TCP/IP stack allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the IPv6 implementation in the Trace TCP/IP stack is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Staking tokens can be stolen

Lines of code Vulnerability details Impact The staking contract keeps track of shares of each user. When withdrawing from the staking contract the amount parameter is converted to shares and this value is decreased shares = amount / totalbalance totalshare. This shares calculation rounds down whi...

Owner can set arbitrary premium which allow nonStakers drain funds

Handle wuwe1 Vulnerability details Impact Owner can set arbitrary premium, this will cause protocol lose all the activeBalance, stakers lose all the claimable premium and nonStakers can drain all the usdc. Proof of Concept setProtocolPremium does not check the value of premium. premium can be...

Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5229-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5229-1 advisory. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could...

PartKeepr 信息泄露漏洞

PartKeepr is an inventory management software designed primarily for electronic components. a security vulnerability exists in PartKeepr, which stems from the use of a file:// URL that allows attachments to be loaded when creating parts, which can be exploited by an authenticated attacker to read...

The vulnerability of the implementation of the Control Point and Wireless Access Point Provisioning Protocol (CAPWAP) in the Cisco IOS XE operating system allows a attacker to trigger a service failure.

The vulnerability of the CAPWAP management protocol implementation and wireless access point provisioning in Cisco IOS XE operating systems is related to insufficient validation of CAPWAP packets. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

The vulnerability of the CAPWAP control protocol implementation in the Cisco IOS XE operating system allows a attacker to trigger a service failure or execute arbitrary code.

The vulnerability of the CAPWAP control protocol implementation in the Cisco IOS XE operating system is related to buffer overflow errors in dynamic memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code...

Wrong design/implementation of freeTrial allows attacker to steal funds from the protocol

Handle WatchPug Vulnerability details The current design/implementation of freeTrial allows users to get full refund before the freeTrial ends. Plus, a user can transfer partial of thier time to another user using shareKey. This makes it possible for the attacker to steal from the protocol by...

The vulnerability of the Windows Remote Desktop Protocol allows a perpetrator to gain unauthorized access to a device.

The vulnerability of the Windows Remote Desktop Protocol in the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to the device...

Microsoft Windows Remote Desktop Protocol 信息泄露漏洞

Microsoft Windows Remote Desktop Protocol RDP is a Microsoft application for connecting to remote Windows desktops. An information disclosure vulnerability exists in Microsoft Windows RDP. The following products and versions are affected:Windows 10 Version 1809 for 32-bit Systems,Windows 10 Versi...

Anyone can call harvestNextStrategy with a very low amount of _estimated tokens

Handle tensors Vulnerability details Impact The amounts estimatedWETH and estimatedYAXIS are lower bounds that the protocol expects to recieve. An attacker can call havervestNextStrategyvault, 1, 1 after manipulating the pools called in harvest and swap. The protocol sees nothing wrong with only...