PYSEC-2022-43055

Hyperledger Fabric 2.3 allows attackers to cause a denial of service orderer crash by repeatedly sending a crafted channel tx with the same Channel name. NOTE: the official Fabric with Raft prevents exploitation via a locking mechanism and a check for names that already exist...

CVE-2022-45196

Hyperledger Fabric 2.3 allows attackers to cause a denial of service orderer crash by repeatedly sending a crafted channel tx with the same Channel name. NOTE: the official Fabric with Raft prevents exploitation via a locking mechanism and a check for names that already exist...

Xenstore: Guests can create arbitrary number of nodes via transactions (XSA-421)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a vulnerability in its node creation feature. In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an...

BLOCK_PERIOD is incorrect

Lines of code Vulnerability details The BLOCKPERIOD is set to 13 seconds in Config.sol. uint256 constant BLOCKPERIOD = 13 seconds; Since moving to Proof-of-Stake PoS after the Merge, block times on ethereum are fixed at 12 seconds per block slots. . Impact This results in incorrect calculation of...

WHEN EVER CALLING bridgeMint OR bridgeBurn FUNCTIONS NEED TO CHECK THE STATUS OF THE TRANSACTIONS

Lines of code Vulnerability details Impact If not checking the status of the bridgeMint and bridgeBurn functions we don't know the the transactions are success or not. If function breaks any of the reasons we don't what happened and what is the status of the transactions. there is no solutions...

msg.sender token balance is not checked before calling safeTransferFrom function

Lines of code Vulnerability details Impact createAuction FUNCTION and bid FUNCTION: Without checking the msg.sender token balance the transfer function may be failed to transfer token from msg.sender to contract address . this may cause a transactions failures. Same instance in 2 times PROOF OF...

Asymmetric level of transaction validation between L1 side and L2.

Lines of code Vulnerability details Impact May have double counting of deposits? Proof of Concept On L1 side, there are validations that ensure funds don't get lost nor double counted. For example, finalizeWithdrawal may be called multiple times by allowed callers in case previous calls fail...

Security Bulletin: An identity spoofing vulnerability in IBM WebSphere Application Server Liberty (CVE-2022-22476) affects CICS Transaction Gateway

Summary An identity spoofing vulnerability exists in IBM WebSphere Application Server Liberty used by CICS Transaction Gateway. CICS Transaction Gateway has addressed the vulnerability CVE-2022-22476 Vulnerability Details CVEID:CVE-2022-22476 DESCRIPTION: IBM WebSphere Application Server Liberty...

jboss-client: memory leakage in remote client transaction

A flaw was found in the jboss-client. A memory leak on the JBoss client-side occurs when using UserTransaction repeatedly, leading to an information leakage vulnerability...

jboss-client: memory leakage in remote client transaction

A flaw was found in the jboss-client. A memory leak on the JBoss client-side occurs when using UserTransaction repeatedly, leading to an information leakage vulnerability...

jboss-client: memory leakage in remote client transaction

A flaw was found in the jboss-client. A memory leak on the JBoss client-side occurs when using UserTransaction repeatedly, leading to an information leakage vulnerability...

GHSA-7FW6-6MFJ-G3Q2 ckb: Transaction header_deps validation issue (network forking)

Impact fn HeaderCheckercheckvalid skipped main chain checking after this PR: https://github.com/nervosnetwork/ckb/pull/1646/filesdiff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176 It will cause network forking if one transaction is using a forked block header which is...

ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.

Impact When a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles. Patches In 0.43.3, nodes drop the transactions relayed to them when they contain a dep group with more than 64 cells. They do not ba...

GHSA-9MFC-CHWF-7WHF ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.

Impact When a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles. Patches In 0.43.3, nodes drop the transactions relayed to them when they contain a dep group with more than 64 cells. They do not ba...

ALPINE-CVE-2022-42325

Xenstore: Guests can create arbitrary number of nodes via transactions This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. In case a node has been created in a transaction and it is later deleted in the same transaction, t...

CVE-2022-42325

Xenstore: Guests can create arbitrary number of nodes via transactions This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. In case a node has been created in a transaction and it is later deleted in the same transaction, t...

DEBIAN-CVE-2022-42325

Xenstore: Guests can create arbitrary number of nodes via transactions This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. In case a node has been created in a transaction and it is later deleted in the same transaction, t...

DEBIAN-CVE-2022-42312

Xenstore: guests can let run xenstored out of memory This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service...

CVE-2022-42325

Xenstore: Guests can create arbitrary number of nodes via transactions This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. In case a node has been created in a transaction and it is later deleted in the same transaction, t...

CVE-2022-42310

Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is...