App Layering - Stuck Tasks or new tasks hang at "pending" or "stalled"

Tasks won't progress, appear as stalled. New tasks sit at "Pending" From maservice.log: 2021-01-11 09:10:25,575 WARN 20193 UnitOfWorkImplemen: Transaction is implicitly being rolled back at Uni.Appliance.PersistenceLayer.UnitOfWork.UnitOfWorkImplementation.Dispose 0x00025 in :0 at...

Mobile Events Manager < 1.4.8 - Admin+ CSV Injection

The plugin does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability. Export events with malicious CSV: 1. Create and save a new Enquiry source and add the following in the name field...

Users will never receive their borrow amount after tx the collateral

Lines of code Vulnerability details Impact You are not able to receive any borrowed amount after adding addCollateral Proof of Concept By invoking addCollateral you will transfer an amount of collateralAmount to the Pair But you will receive any borrowed amount Recommended Mitigation Steps Invoke...

CVE-2022-33988

dproxy-nexgen aka dproxy nexgen re-uses the DNS transaction id TXID value from client queries, which allows attackers able to send queries to the resolver to conduct DNS cache-poisoning attacks because the TXID value is known to the attacker...

Code injection

dproxy-nexgen aka dproxy nexgen re-uses the DNS transaction id TXID value from client queries, which allows attackers able to send queries to the resolver to conduct DNS cache-poisoning attacks because the TXID value is known to the attacker...

CVE-2022-33988

dproxy-nexgen aka dproxy nexgen re-uses the DNS transaction id TXID value from client queries, which allows attackers able to send queries to the resolver to conduct DNS cache-poisoning attacks because the TXID value is known to the attacker...

CVE-2022-33988

CVE-2022-33988 affects dproxy-nexgen (DNS proxy). The issue is the reuse of the DNS TXID from client queries, enabling an attacker who can send queries to the resolver to perform DNS cache poisoning. Exploitation status is not detailed in the provided documents; no concrete patch/version remediat...

dproxy 环境问题漏洞

dproxy is an intelligent caching DNS proxy from the personal developer Matthew Pratt. A security vulnerability exists in dproxy that stems from its reuse of DNS transaction ID values from client queries leading to an attacker performing a DNS cache poisoning attack...

createLock: User can lose funds by sending a wrong _value parameter

Lines of code Vulnerability details Impact Users can lose funds by sending a wrong value parameter. The problems relays in casting value to int128. Solidity does not check casting, just math operations. If a user tries to lock an amount greater than 2^128, the transaction won't be reverted and...

[M1] Incorrect amount of gas sent in _distributeFunds

Lines of code Vulnerability details Impact In case recipients consume more gas than expected the transaction could revert or cost can be too high. Proof of Concept According to the definition of the variable SENDVALUEGASLIMITMULTIPLERECIPIENTS you intend to use all that gas for all recipients. /...

PT-2022-14593 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds write due to an integer overflow in the construct transaction function of lwis ioctl.c. This could lead to local escalation of privilege in the kernel, requiring...

HackerOne: Ability to escape database transaction through SQL injection, leading to arbitrary code execution

HackerOne has an internal backend interface that gives debugging capabilities to its engineers. One of the features is the ability to run EXPLAIN ANALYZE queries against a connected database. This feature is accessible by a handful of engineers. The feature is vulnerable to a SQL injection that...

PTP-03: Unsafe logic in repayLender() function

Lines of code Vulnerability details PTP-03: Unsafe logic in repayLender function Impact reduceDebt internal function is called before the actual transfer of tokens, meaning that it doesn't matter if the transaction fails or succeeds for any reason, debt will be reduced, causing a loss for the...

Add cancel and refund option for Transaction Recovery

Lines of code Vulnerability details Add cancel and refund option for Transaction Recovery Impact Transactions could fail or stuck, according to the documentation: Occasionally, transactions can get "stuck" in the pipeline from a source to destination chain e.g. due to one-off issues that arise wi...

Weak Transfer Logic

@solana/pay adopts a weak transfer logic. It doesn't properly check if a transaction is valid Solana Pay transfer, ending up validating multiple transfers...

CVE-2022-34163

IBM CICS TX 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 229333...

CVE-2022-34162

IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM...

IBM CICS TX 操作系统命令注入漏洞

IBM CICS TX is a comprehensive, single transaction runtime package from IBM USA. An operating system command injection vulnerability exists in IBM CICS TX version 11.1 that originates from allowing an attacker with physical access to the system to execute code using a return and refresh attack...

IBM CICS TX 安全漏洞

IBM CICS TX Advanced is a comprehensive, single transaction runtime package from IBM USA. It can provide a cloud-native deployment model for standalone applications. An Access Control Error vulnerability exists in IBM CICS TX Advanced version 11.1, which stems from a failure to set a security...

Fedora: Security Advisory for golang-github-hashicorp-memdb (FEDORA-2022-ea8f4e232d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...