The vulnerability of the Data Transfer component in Google Chrome and Microsoft Edge browsers allows attackers to trigger service interruptions or increase their privileges.

The vulnerability of the Data Transfer component in Google Chrome and Microsoft Edge is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause service interruptions or increase their privileges through a specially created web page...

ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host

Ruby's Net::FTP module trusted the IP address included in the FTP server's response to the PASV command. A malicious FTP server could use this to make Ruby applications using the Net::FTP module to connect to arbitrary hosts and use this to perform port scanning or information extraction from...

ruby: Potential HTTP request smuggling in WEBrick

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...

ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host

Ruby's Net::FTP module trusted the IP address included in the FTP server's response to the PASV command. A malicious FTP server could use this to make Ruby applications using the Net::FTP module to connect to arbitrary hosts and use this to perform port scanning or information extraction from...

ruby: Potential HTTP request smuggling in WEBrick

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...

TurboRouter: deposit(), mint(), createSafeAndDeposit() and createSafeAndDepositAndBoost() functions may be vulnerable to FRONT-RUN attack

Lines of code Vulnerability details Impact The TurboRouter contract inherits from the PeripheryPayments contract. To execute the deposit, mint, createSafeAndDeposit and createSafeAndDepositAndBoost functions of the TurboRouter contract, the user needs to first execute the pullToken and approve...

ERC4626 does not work with fee-on-transfer tokens

Lines of code Vulnerability details Impact The docs/video say ERC4626.sol is in scope as its part of TurboSafe The ERC4626.deposit/mint functions do not work well with fee-on-transfer tokens as the amount variable is the pre-fee amount, including the fee, whereas the totalAssets do not include th...

ERC4626 mints more shares than it should

Lines of code Vulnerability details bug in the mint function of the ERC4626 contract The mint function recieves an amount of shares and an address to and mints the amount of shares to the to address. The sender must transfer an amount of token, so that the ratio will be saved - shares / totalShar...

GSD-2022-1000190 usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS

usb: gadget: fsourcesink: Fix isoc transfer for USBSPEEDSUPERPLUS This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.96 by commit...

GSD-2022-1000080 usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS

usb: gadget: fsourcesink: Fix isoc transfer for USBSPEEDSUPERPLUS This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.300 by commit...

CVE-2022-24047

This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of...

TurboRouter: deposit(), mint(), createSafeAndDeposit() and createSafeAndDepositAndBoost() functions do not work

Lines of code Vulnerability details Impact The TurboRouter contract inherits from the ERC4626RouterBase contract. When the user calls the deposit, mint, createSafeAndDeposit and createSafeAndDepositAndBoost functions of the TurboRouter contract, the deposit and mint functions of the...

PT-2022-28400

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.19.195 through 4.19.227 Description The issue affects the USB gadget functionality, specifically the f sourcesink component, where an isoc transfer problem occurs at USB SPEED SUPER PLUS. The actual impact and potential...

PT-2022-28429

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 5.4.126 through 5.4.175 Description The issue affects the f sourcesink component in the USB gadget subsystem, specifically impacting isochronous transfer for USB SPEED SUPER PLUS. The actual impact and attack plausibility...

PT-2022-28528

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.13 through v5.15.18 Description The issue affects the f sourcesink function in the USB gadget subsystem, specifically impacting isochronous transfer for USB SPEED SUPER PLUS. The actual impact and attack plausibility...

PT-2022-28376

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.14.237 through 4.14.264 Description The issue affects the f sourcesink function in the USB gadget subsystem, specifically with isoc transfer for USB SPEED SUPER PLUS. The actual impact and attack plausibility have not y...

PT-2022-28468

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 5.10.44 through 5.10.95 Description The issue affects the f sourcesink component in the USB gadget subsystem, specifically impacting isochronous transfer for USB SPEED SUPER PLUS. The actual impact and attack plausibility...

Missing briber check is equal to address(this), can cause imbalance between the bribe amount, and the actual balance that the contract has

Lines of code Vulnerability details Impact the depositBribeERC20 is called from https://github.com/code-423n4/2022-02-redacted-cartel/blob/main/contracts/TokemakBribe.sol, however if there is a malicious user that had depositor role, this user can call depositBribeERC20 and set the briber to the...

DEPOSITOR_ROLE can manipulate b.amount value

Lines of code Vulnerability details Impact Malicious DEPOSITORROLE can doing self transfer and manipulate b.amount Proof of Concept In case malicious DEPOSITORROLE inputing WETH address and putting briber == addressthis in safeTransferFrom argument which is self transfering. Therefore, it is...

Tokens are directly transferred from briber to BribeVault

Lines of code Vulnerability details Impact Function depositBribeERC20 in BribeVault transfers tokens directly from the briber: // Since this method is called by a depositor contract, we must transfer from the account // that called the depositor contract - amount must be approved beforehand...