OpenZeppelin Contracts ERC165Checker unbounded gas consumption

Impact The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. Patches The issue has been fixed in v4.7.2. References...

Calculating project cost is vulnerable to reaching block gas-limit

Lines of code Vulnerability details Impact The function Project.projectCost calculates the project costs by calculating the sum of all project task costs. However, due to the unbound for loop, iterating over a potentially large amount of project tasks, this function can potentially DoS due to...

Possible DOS in lendToProject() and toggleLendingNeeded() function because unbounded loop can run out of gas

Lines of code Vulnerability details Impact In Project contract, the lendToProject function might not be available to be called if there are a lot of Task in tasks list of project. It means that the project cannot be funded by either builder or community owner. This can happen because lendToProjec...

Denial Of Service (DoS)

openzeppelin is vulnerable to denial of service DoS attacks. A malicious user is able to use a target contract of an EIP-165 supportsInterface query to cause unbounded resource consumption by returning a lot of data, causing the application to crash...

CVE-2022-35915 Unbounded gas consumption in @openzeppelin/contracts

OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. The issue has been fixed in...

PT-2022-23021 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions prior to 4.7.2 Description: The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a...

CVE-2022-35220

Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user privilege posting a thread with large content can cause the receiving client device to allocate too much memory, leading to abnormal terminati...

Upgraded Q -> M from 264 [1659038303960]

Judge has assessed an item in Issue 264 as Medium risk. The relevant finding follows: L-05 Unbounded loop on array can lead to DoS As these arrays can grow quite large only push operations, no pop, the transaction's gas cost could exceed the block gas limit and make it impossible to call the...

CVE-2022-35639

IBM Sterling Partner Engagement Manager 6.1, 6.2, and Cloud 22.2 do not limit the length of a connection which could cause the server to become unresponsive. IBM X-Force ID: 230932...

MGASA-2022-0261 Updated java packages fix security vulnerability

OpenJDK: Defective secure validation in Apache Santuario Libraries, 8278008 CVE-2022-21476 OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions JAXP, 8270504 CVE-2022-21426 OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler Libraries, 8277672...

Allocation of Resources Without Limits or Throttling

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report: An attacker can cause unbounded memory growth in servers accepting HTTP/2 requests. Remediation...

Allocation of Resources Without Limits or Throttling

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report: The crypto/x509 package does not limit the amount of work performed for each chain...

OESA-2022-1744 curl security update

Security Fixes: A vulnerability was found in curl. This issue occurs because it mishandles message verification failures when curl does FTP transfers secured by krb5. This flaw makes it possible for a Man-in-the-middle attack to go unnoticed and allows data injection into the client.CVE-2022-3220...

DEBIAN-CVE-2022-32206

curl 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually...

sidekiq: WebUI Denial of Service caused by number of days on graph

A denial of service vulnerability was found in job scheduler sidekiq. An attacker can request statistics for the graph and, since there were no limits on the days parameter, overload the system, affecting the WebUI...

GO-2022-0461 Unbounded memory consumption in github.com/pion/dtls/v2

Attacker can cause unbounded memory consumption. The Pion DTLS client and server buffer handshake data with no upper limit, permitting an attacker to cause unbounded memory consumption by sending an unterminated handshake...

GHSA-22P3-QRH9-CX32 URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths

Impact URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether. It is possible to...

URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths

Impact URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether. It is possible to...

Denial Of Service (DoS)

matrixsynapse is vulnerable to denial of service attacks. An authenticated attacker is able to exhaust the available stack space for the Synapse process due to unbounded recursion, resulting in a system crash. The deployments with urlpreviewenabled: true configuration are affected...

FreeBSD : py-matrix-synapse -- unbounded recursion in urlpreview (07c0d782-f758-11ec-acaa-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 07c0d782-f758-11ec-acaa-901b0e9408dc advisory. - Synapse is an open source home server implementation for the Matrix chat network. In versions prior t...