CVE-2023-38695

CVE-2023-38695 affects the cypress-image-snapshot plugin (used with Cypress). The vulnerability allows a user to pass a relative file path as the snapshot name, enabling path traversal outside the project directory on the machine running tests. This is mitigated by upgrading to version 8.0.2 or l...

CVE-2023-38695 cypress-image-snapshot vulnerable to insecure snapshot file names

cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. This issue has been patched in...

cypress-image-snapshot path traversal vulnerability

cypress-image-snapshot is an image snapshot plugin from the individual developer Simon Smith. A path traversal vulnerability exists in cypress-image-snapshot, which stems from a vulnerability that could allow a user to pass a relative file path as a snapshot name and access machines outside of th...

Path Traversal

@simonsmith/cypress-image-snapshot is vulnerable to Path Traversal. The vulnerability exists because the library does not properly sanitize snapshot filenames, allowing an attacker to create directories or images outside the restricted directory...

FC-Only Nimble Array Snapshot Failures in Veeam Backup & Replication P20230718

Challenge When using Veeam Backup & Replication 12 P20230718, rescan, backup, and restore operations may fail when the Nimble array is configured to only use Fibre Channel FC protocol. The request could not be understood by the server. Unexpected argument 'multiinitiator'. Solution A private fix ...

Unexpected Snapshot Deletion Failures in the Job Sessions for ONTAP 9.13.1

Article Applicability The issue documented in this article affects builds 12.0.0.1420 P20230718 and lower. This issue was resolved starting in Veeam Backup & Replication build 12.1.0.2131. Challenge VeeamAUX snapshots cannot be deleted immediately on ONTAP 9.13.1 or later; they are instead delete...

GHSA-VXJG-HCHX-CC4G @simonsmith/cypress-image-snapshothas fix for insecure snapshot file names

Impact It's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. Example: js cy.get'h1'.matchImageSnapshot'../../../ignore-relative-dirs' The above will create an ignore-relative-dirs.png three levels ...

@simonsmith/cypress-image-snapshothas fix for insecure snapshot file names

Impact It's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. Example: js cy.get'h1'.matchImageSnapshot'../../../ignore-relative-dirs' The above will create an ignore-relative-dirs.png three levels ...

PT-2023-26560 · Unknown · Cypress-Image-Snapshot

Name of the Vulnerable Software and Affected Versions: cypress-image-snapshot versions prior to 8.0.2 Description: The issue allows a user to pass a relative file path for the snapshot name, potentially reaching outside of the project directory into the machine running the test. This can be...

Incorrect liquidity calculations if snapshot errors occur

Lines of code Vulnerability details Impact incorrect liquidity values that undermine the risk checks and constraints of the protocol Proof of Concept getHypotheticalAccountLiquidityInternal does not handle snapshot errors properly. Specifically: It calls MToken.getAccountSnapshot to get the...

CVE-2022-4909

Inappropriate implementation in XML in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially perform an ASLR bypass via a crafted HTML page. Chromium security severity: Low...

Vulnerability fixed in Veritas NetBackup Snapshot Manager

Veritas has fixed a vulnerability in NetBackup Snapshot Manager. Due to a flaw in the way client certificates are processed, it is possible for a malicious party to access backups and restores for which the malicious party is not authorized. This allows the malicious party to gain access to...

The fork escrow voting should use the snapshot mechanism to save whether the current DAO state reaches the fork threshold

Lines of code Vulnerability details Impact The fork escrow vote does not use the snapshot mechanism or checkpoint mechanism to save whether the current DAO state reaches the fork threshold, which may cause the timing of the fork to be missed. Proof of Concept Suppose the following scenario: 1. Wh...

OPENSUSE-SU-2023:0166-1 Security update for virtualbox

This update for virtualbox fixes the following issues: - Fix Vagrant/virtualbox startup problems boo1209727 - VirtualBox 7.0.8 released April 18 2023 This is a maintenance release. The following items were fixed and/or added: - VMM: Introduced general improvements in nested visualization area -...

Moderate: Red Hat Security Advisory: virt:rhel and virt-devel:rhel security and bug fix update

An update for the virt:rhel and virt-devel:rhel modules is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Exploit for CVE-2023-31595

CVE-2023-31595 IC Realtime ICIP-P2012T is vulnerable to Incorr...

Borrowers can be liquidated before default by being based on the borrowBalance from other pools

Lines of code Vulnerability details Impact Borrower can be liquidated before default based on the borrowBalance from other pools. In the liquidity snapshot, borrows from other pools are added as total borrow but the collateral that is used which might not be used as collateral for the poolfor the...

PT-2024-39: Readout protection level bypass before the first power-on cycle in GigaDevice Semiconductor products

The vulnerability of readout protection level bypass before the first power-on cycle was identified in series GD32F1x0, GD32F4xx, GD32F3x0 of GigaDevice Semiconductor products. The discovered vulnerability can be exploited by an attacker to take a snapshot of RAM before initialization or to chang...

Virtuozzo Hybrid Infrastructure 5.4 Update 1 Hotfix 1 (5.4.1-61)

This update provides stability fixes for the compute service. Vulnerability id: VSTOR-66686 If there is a network port with the address 0.0.0.0/0, a VM creation fails with the error 'Failed to allocate the networks, not rescheduling.' Vulnerability id: VSTOR-67068 Snapshot metrics per storage...

Virtuozzo Hybrid Infrastructure 5.3 Update 1 Hotfix 2 (5.3.1-47)

This update provides stability fixes for the compute, object storage, and core storage services. Vulnerability id: VSTOR-65934 After an update from 5.2.x to 5.3.x, the object storage may not be started due to an invalid configuration file. Vulnerability id: VSTOR-63084 Unable to manage a virtual...