286 matches found
Security Bulletin: A vulnerability in OpenSSL affects IBM InfoSphere Information Server (CVE-2022-0778)
Summary A vulnerability in OpenSSL used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw in the BNmodsqrt function when parsing certificates. By using a specially-crafted...
Pool with any fee tier can be created
Lines of code Vulnerability details Impact Pool with any fee tier can be created Proof of Concept There is a section in this medium: In Fee Structure: Maverick AMM supports initializing pools with arbitrary fee rates, but it is expected that LPs will choose from one of the following “standard” fe...
Security Bulletin: IBM InfoSphere Information Server is affected by a denial of service vulnerability in Apache Kafka (CVE-2022-34917)
Summary A denial of service vulnerability in Apache Kafka used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2022-34917 DESCRIPTION: Apache Kafka is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted request...
Elon Musk Confirms Twitter 2.0 will Bring End-to-End Encryption to Direct Messages
Twitter chief executive Elon Musk confirmed plans for end-to-end encryption E2EE for direct messages on the platform. The feature is part of Musk's vision for Twitter 2.0, which is expected to be what's called an "everything app." Other functionalities include longform tweets and payments,...
tier-fotos.eu Cross Site Scripting vulnerability OBB-3061351
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
How to prevent lateral movement attacks using Microsoft 365 Defender
It’s been 10 years since the first version of the Mitigating Pass-the-Hash Attacks and Other Credential Theft whitepaper was made available, but the techniques are still relevant today, because they help prevent attackers from gaining a network foothold and using credential-dumping tools to extra...
How to prevent lateral movement attacks using Microsoft 365 Defender
It’s been 10 years since the first version of the Mitigating Pass-the-Hash Attacks and Other Credential Theft whitepaper was made available, but the techniques are still relevant today, because they help prevent attackers from gaining a network foothold and using credential-dumping tools to extra...
Deactivated tiers can still mint reserve tokens, even if no non-reserve tokens were minted.
Lines of code Vulnerability details Description Tiers in Juicebox can be deactivated using the adjustTiers function. It makes sense that reserve tokens may be minted in deactivated tiers, in order to be consistent with already minted tokens. However, the code allows the first reserve token to be...
Miss tier 0 when looping through all tiers
Lines of code Vulnerability details Impact Miss tier 0 when looping through all tiers, which will result in wrong data as not all tiers data are counted. Proof of Concept Tools Used Recommended Mitigation Steps Include the tier 0 when looping through all tiers and modify the codes to as follows:...
Future tier can be removed
Lines of code Vulnerability details Impact A newly created tier can be marked as removed right after it was added if this tier's ID was mistakenly removed earlier. Proof of Concept The recordRemoveTierIds function doesn't check whether a tier ID exists or not JBTiered721DelegateStore.solL890:...
Changing default reserved token beneficiary may result in wrong beneficiary for tier
Lines of code Vulnerability details Impact When the reservedTokenBeneficiary of a tier is equal to defaultReservedTokenBeneficiaryOfmsg.sender, it is not explicitly set for this tier. This generally works well because in the function reservedTokenBeneficiaryOfaddress nft, uint256 tierId,...
Owner can set lockUntil to a very large timestamp to create not-removeable tier and not-pause-able tier
Lines of code Vulnerability details Impact Owner can set lockUntil to a very large timestamp to create not-removeable tier. when a tier is created, the owner can set lockUntil parameter @member lockedUntil The time up to which this tier cannot be removed or paused. when the owner call adjustTier,...
VulnCheck KEV: CVE-2018-2628
Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server...
Detecting malicious key extractions by compromised identities for Azure Cosmos DB
Azure Cosmos DB is a fully managed NoSQL cloud database service for modern app development. It offers a variety of advanced built-in features, such as automatic worldwide data replication, lightning-fast response types, and a variety of APIs. In this blog post, we describe security practices for...
Detecting malicious key extractions by compromised identities for Azure Cosmos DB
Azure Cosmos DB is a fully managed NoSQL cloud database service for modern app development. It offers a variety of advanced built-in features, such as automatic worldwide data replication, lightning-fast response types, and a variety of APIs. In this blog post, we describe security practices for...
How to Connect to an Object Storage Repository via Google Cloud Private Access
Purpose This article documents how to configure Veeam Backup & Replication to use Google Cloud Private Access to connect to a GCS bucket instead of the public IPs for Scale-Out Backup Repository offload to Capacity Tier or Archive Tier or to connect to an Object Storage Repository in Veeam Backup...
Helper Appliance Resource Requirements
Purpose This article documents the specific EC2 Instance Type / Azure VM Size that will be used by Veeam Backup & Replication based on the Helper Appliance size selected when adding Amazon S3 or Azure Object Storage. Solution Helper Appliance Sizes The table below documents the actual EC2 Instanc...
Offload to Capacity Tier fails with: Scale-out repository rescan is required: performance tier is not synchronized with capacity tier.
Challenge SOBR Offload task fails with the error: Error: Backup file version mismatch: scale-out backup repository rescan is required. Cause There is a discrepancy between the information within the Veeam Backup & Replication configuration database and the metadata in the object storage repositor...
SUSE: Security Advisory (SUSE-SU-2022:0843-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
