4415 matches found
Design/Logic Flaw
Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI to gain arbitrary code execution on the system...
CVE-2022-34398
Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI to gain arbitrary code execution on the system...
PT-2023-13032 · Cypress · Cypress Bluetooth Mesh Sdk
Name of the Vulnerable Software and Affected Versions: Cypress Bluetooth Mesh SDK version BSA0107 05.01.00-BX8-AMESH-08 Description: The issue is related to a buffer overflow that can allow the execution of arbitrary code remotely. It is caused by an out-of-bound write vulnerability during mesh...
CVE-2022-31363
Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA010705.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary code remote. The component is: affected function is pbtransporthandlefrag. ¶¶ In Cypress Bluetooth Mesh SDK, there is an out-of-bound write...
ASB-A-257685302
In bindertransactionbufferrelease of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
GSD-2023-1001737 btrfs: do not abort transaction on failure to write log tree when syncing log
btrfs: do not abort transaction on failure to write log tree when syncing log This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.90 by commit...
PT-2023-34813 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.90 Description: The issue is related to the btrfs file system, where a failure to write the log tree when syncing the log does not abort the transaction. This could potentially lead to security...
Overflow Vulnerability in Splits Contract Due to Maximum Splits Receivers Limitation (_MAX_SPLITS_RECEIVERS = 200)
Lines of code Vulnerability details Impact If more than 200 splits receivers are added for a single user, the constant MAXSPLITSRECEIVERS will be exceeded, causing unexpected behavior in the contract uint256 internal constant MAXSPLITSRECEIVERS = 200; Proof of Concept a. Create an array of splits...
Anyone Can Collect The Transaction Fees
Lines of code Vulnerability details Impact collectTransactionFees is a function that should be only calles by the liquidity providers , but the the flow of the function no restriction , lets anyone collect the fees. Proof of Concept 1. Alice decides to collect the fees of pool A for example 2...
All Transfer Hooks have incomplete checks which might lead to transactions reverting
Lines of code Vulnerability details Impact Due to not checking that the ids array and amounts array are same , if given the two arraya of non-equal length it might lead to incorrect token transfers and unwanted transaction reverts. Proof of Concept According to the EIP specification the ids array...
[M] TimeswapV2LiquidityToken.sol#collect() Incorrect implementation causing collect always fail
Lines of code Vulnerability details Impact The function collect in the provided code is supposed to transfer transaction fees from a liquidity token position to a recipient address. However, the function currently has an issue where the long0Fees, long1Fees, and shortFees variables are not...
Managing Incomplete Transactions in the _assertConsiderationLengthIsNotLessThanOriginalConsiderationLength Function
Lines of code Vulnerability details Impact In the assertConsiderationLengthIsNotLessThanOriginalConsiderationLength function, the revertMissingOriginalConsiderationItems function is called if the supplied consideration item total is less than the original consideration item total. However, there ...
Upgraded Q -> M from #113 [1674422768939]
Judge has assessed an item in Issue 113 as M risk. The relevant finding follows: During handling the open fees, the tigAsset is distributed to gov. But, it is not approved before to be consumed by gov. So, the first user's transaction to initiate a market order, will fail. During handling the clo...
PT-2023-9596
Name of the Vulnerable Software and Affected Versions Sentry SDK versions prior to 1.14.0 Description The issue is related to the leakage of sensitive cookie values, including session cookies, to Sentry when using the Django integration of the Sentry SDK in a specific configuration. This can occu...
GSD-2023-1000439 ext4: don't set up encryption key during jbd2 transaction
ext4: don't set up encryption key during jbd2 transaction This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.18 by commit...
PT-2023-33978 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.87 Description: The issue is related to the ext4 file system, where an encryption key is set up during a jbd2 transaction. The actual impact and attack plausibility have not yet been proven. Recommendation...
HTML Injection in add expense via transaction tab
Steps to reproduce After login into demo account, Go to the transaction page and there your can add or create an expense If your on the write path, while creating or adding an expense there will be description field In the Description field, enter the following payload Y00 and click save Now, you...
CVE-2022-46952
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=deleteuser...
