Interest is not accrued before parameters are updated in SavingsVest

Lines of code Vulnerability details Impact Stablecoin holders can receive wrongly calculated yield in the SavingsVest contract. Also, wrong vesting profit can be slashed when the protocol is under-collateralized. Proof of Concept The SavingsVest contract lets users deposit their stablecoins and...

User may get less tokens than expected when collateral list order changes

Lines of code Vulnerability details Impact The order of ts.collateralList is not stable: Whenever LibSetters.revokeCollateral is used to revoke a collateral, it may change because of the swap that is performed. However, the function Redeemer.redeem relies on this order, as the user has to provide...

Virtuozzo Hybrid Infrastructure 5.4 Update 3 (5.4.3-100)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover core storage, the system configuration, updates, documentation, and the compute services. Additionally, this release delivers stability improvements and addresses issues found in previous releases...

potential arithmetic overflow in the code under review.

Lines of code Vulnerability details Summary This report highlights a high vulnerability related to potential arithmetic overflow in the code under review. Vulnerability Details The code performs arithmetic operations, such as addition, subtraction, multiplication, and division, on sdk.Int values...

Virtuozzo Hybrid Infrastructure 5.4 Update 2 Hotfix 1 (5.4.2-66)

This update provides important improvements for the core storage and compute services. Vulnerability id: VSTOR-69329 The compute networking service may get stuck after an update to version 5.4 Update 2. Vulnerability id: VSTOR-66925, VSTOR-68759, VSTOR-69819 Important stability improvements...

CVE-2023-3268

An out-of-bounds OOB memory access flaw was found in the Linux kernel in relayfilereadstartpos in kernel/relay.c in the relayfs. This flaw allows a local attacker to crash the system or leak kernel internal information. Mitigation Mitigation for this issue is either not available or the currently...

Rudder Server SQLI Remote Code Execution

This Metasploit module exploits a SQL injection vulnerability in RudderStack's rudder-server, an open source Customer Data Platform CDP. The vulnerability exists in versions of rudder-server prior to 1.3.0-rc.1. By exploiting this flaw, an attacker can execute arbitrary SQL commands, which may le...

CLSA-2023-1686585068 kernel: Fix of 26 CVEs

cgroup: Use open-time cgroup namespace for process migration perm checks CVE-2021-4197 - cgroup: Use open-time credentials for process migraton perm checks CVE-2021-4197 - cgroup: cgroup.procs,threads factor out common parts - cgroup: unify attach permission checking - vt: drop old FONT ioctls...

CVE-2023-3141

A use-after-free flaw was found in r592remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This issue may allow a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. Mitigation Mitigation for this issue is either not...

TerraMaster TOS 4.2.06 Remote Code Execution Exploit

This Metasploit module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS versions 4.2.06 and below via shell metacharacters in the Event parameter at vulnerable endpoint include/makecvs.php during CSV creation. Any unauthenticated user can therefore execute comman...

Custom redemption might revert if old assets were unregistered

Lines of code Vulnerability details quoteCustomRedemption works under the assumption that the maximum size of the erc20sAll should be assetRegistry.size, however there can be cases where an asset was unregistered but still exists in an old basket, making the size of the old basket greater than...

Virtuozzo PowerPanel Update 2 Hotfix 1 (7.0.4-77)

The update for Virtuozzo PowerPanel introduces stability fixes. Vulnerability id: PP-746 Controller installation may fail with a credentials-related error...

MGASA-2023-0174 Updated suricata packages fix security vulnerability

Various security, performance, accuracy and stability issues. See referenced package announcements for details...

Updated suricata packages fix security vulnerability

Various security, performance, accuracy and stability issues. See referenced package announcements for details...

PT-2023-36343 · Mageia · Suricata

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue involves various security, performance, accuracy, and stability problems. For detailed information, refer to the announcements of the referenced packages. Recommendations: At...

kernel: staging: fbtft: core: set smem_len before fb_deferred_io_init call

A flaw was found in the fbtft module in the Linux kernel. An incorrect order of operations can cause an improper initialization of framebuffer devices, potentially impacting system stability and resulting in a denial of service...

unstake() function: The unstake function permits the unstaking of multiple position NFTs from the same liquidity pool (LP) by the same lender. This opens the possibility for a lender to claim more Ajna token rewards than they are entitled to by staking and unstaking multiple NFTs associated with the same LP.

Lines of code Vulnerability details Impact The absence of a mechanism to prevent a lender from unstaking multiple NFTs for the same liquidity pool LP could potentially lead to the exploitation of the Ajna token reward system. A lender can mint, stake, and unstake multiple NFTs for the same LP fro...

Virtuozzo Hybrid Infrastructure 5.4 Update 2 (5.4.2-58)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover the compute services, core and object storage, integrations, monitoring and alerts. Additionally, this release delivers stability improvements and addresses issues found in previous releases. Vulnerabilit...

PT-2025-25961 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.20.0 Description: A use-after-free issue has been identified in the Linux kernel, specifically in the drm/amdgpu component. This issue arises when amdgpu cs vm handling returns a non-zero value, causing the bo...

CVE-2023-24540

A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be...