Frontier 安全漏洞

Frontier is an EtherCompatible layer for Substrate. It is used to run unmodified Ethernet Dapps. Frontier suffers from a security vulnerability that stems from the truncation done during the conversion between EVM Balance Type and Substrate Balance Type being incorrectly implemented, resulting in...

netty: control chars in header names may lead to HTTP request smuggling

A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling...

Nextcloud 注入漏洞

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an injection vulnerability that stems from susceptibility to SMTP command injection attacks...

[SECURITY] Fedora 36 Update: containerd-1.6.6-4.fc36

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

Using SafeTransferLib as a transfer medium has a certain probability of causing problems

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. function exerciseOrder memory order, uint256 calldata floorAssetTokenIds public payable / CHECKS / bytes32 orderHash = hashOrderorder; // check user owns the position requireownerOfuint256orderHash ==...

Not-yet-exist ERC20 Could Be Used Within An Order

Lines of code Vulnerability details Vulnerability Details It was observed that the PuttyV2 contract uses solmate's SafeTransferLib for pulling ERC20 assets from the order maker or taker to the PuttyV2 contract. There is some difference between the implementation of solmate's SafeTransferLib and...

Contract TresureDelegate.sol could be destructed

Lines of code Vulnerability details Impact The contract simply could be destructed by anyone. Proof of Concept The question is how?! Imagine, that the recipient account has a fallback function with a selfdestruct in it. ./attack.sol contract attack fallback external payable...

How to Monitor Athena Usage to Understand Your Operations, and Control Security and Costs

Introduction to our data lakes experience Data lakes are great. They are flexible as they allow many object formats and multiple query engines. They are also cost effective - there is no need to manage or pay for resources like disks, cpu and memory. Data is simply stored in an object store and i...

[SECURITY] Fedora 36 Update: curl-7.82.0-6.fc36

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Sending 1 wei of cNote to the treasury can malfunction sweepInterest()

Lines of code Vulnerability details function sweepInterest external override if msg.sender != admin revert SenderNotAdminmsg.sender; //Total balance of Treasury = Note + CNote Balance, Exp memory exRate = Expmantissa: cnote.exchangeRateStored; //used stored interest rates in determining amount to...

Users may lose funds due to ignored return value of transfer()

Lines of code Vulnerability details Impact The return value of WETH transfer in is unchecked. So if the transfer fails, it continues to L1386 which returns 0 to compAccruedholdersj in L1370 there by resetting the compAccrued of the holder to zero. With this, the user would lose funds. Proof of...

lack of validating transferFrom of token

Lines of code Vulnerability details Impact As we have not defined the token implementation, it should be validated that token.transferFromfrom, addressthis, amount; return true. This is important, since the transaction could not be carried out and the function executed as correct. In the comments...

lack of validating transfer of tokens entered by the user

Lines of code Vulnerability details Impact As we have not defined the implementation of note, it should be validated that note.transferrecipient, amount returns true. This is important, since the transaction could not be carried out and the function executed as correct. In the comments of the cod...

python: CRLF injection via HTTP request method in httplib/http.client

A flaw was found in Python. The built-in modules httplib and http.client included in Python 2 and Python 3, respectively do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat fr...

CVE-2017-20100

A vulnerability was found in Air Transfer 1.0.14/1.2.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used...

CVE-2017-20100

A vulnerability was found in Air Transfer 1.0.14/1.2.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used...

Cross site scripting

A vulnerability was found in Air Transfer 1.0.14/1.2.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used...

CVE-2017-20100

CVE-2017-20100 pertains to the Air Transfer applications (versions 1.0.14/1.2.1). The issue is a cross-site scripting (XSS) vulnerability caused by an insecure handling/validation of the path parameter in the list/download modules, enabling client-side code execution. The vulnerability is describ...

CVE-2017-20100 Air Transfer cross site scripting

A vulnerability was found in Air Transfer 1.0.14/1.2.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used...

CVE-2017-20100 Air Transfer cross site scripting

A vulnerability was found in Air Transfer 1.0.14/1.2.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used...