Out-of-bounds Write

exfatprogs is vulnerable to Out Of Bounds Write. The vulnerability is found in the readfiledentryset function within exfat2img.c. When the SecondaryCount exceeds a threshold of 2 plus the maximum number of File Name entries, it could potentially lead to writing data to memory locations beyond the...

openSUSE 15 Security Update : libnbd (SUSE-SU-2023:4222-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:4222-1 advisory. - A flaw was found in libnbd. A server can reply with a block size larger than 2^63 the NBD spec states the size is a 64-bit unsigned value. This issue could...

Lender can cause unintended behavior for the borrower's transaction

Lines of code Vulnerability details This vulnerability comes in the form of when a borrower wants to remove a lender as a both deposit and withdraw and set them as a withdraw only, to avoid paying more interest on their funds in the market, this plan may not go as planned, based on the nature of...

Integer Overflow

github.com/consensys/gnark is vulnerable to Integer Overflow. The vulnerability is due to some in-circuit values having two valid decomposition bits, which could result in unintended behavior...

Improper Encoding

firefox is vulnerable to Improper Encoding. The vulnerability exists due to improperly validating curl command which allows an attacker to cause unintended behavior in smart contracts that rely on the sender's accurate identification...

Design/Logic Flaw

A flaw was found in libnbd. A server can reply with a block size larger than 2^63 the NBD spec states the size is a 64-bit unsigned value. This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbdgetsize function...

CVE-2023-5215

A flaw was found in libnbd. A server can reply with a block size larger than 2^63 the NBD spec states the size is a 64-bit unsigned value. This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbdgetsize function...

CVE-2023-5215

A vulnerability CVE-2023-5215 affects libnbd where a server may reply with a block size larger than 2^63, violating the 64-bit unsigned size expectation in nbd_get_size() and potentially causing an application crash or other unintended behavior in NBD clients that mishandle the return value. Conn...

CVE-2023-5215

A flaw was found in libnbd. A server can reply with a block size larger than 2^63 the NBD spec states the size is a 64-bit unsigned value. This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbdgetsize function...

CVE-2023-5215 Libnbd: crash or misbehaviour when nbd server returns an unexpected block size

A flaw was found in libnbd. A server can reply with a block size larger than 2^63 the NBD spec states the size is a 64-bit unsigned value. This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbdgetsize function...

Absence of Start-End Time Validation in Range Creation

Lines of code Vulnerability details The code allows the creation of a Range structure without ensuring that startTime is strictly less than endTime. The absence of this validation might lead to unintended behavior or logical errors in functionalities that rely on the order of these timestamps...

Unsafe safeTransfer function

Lines of code Vulnerability details Impact The safeTransfer function of the SafeERC20.sol contract check that the target is actually a contract before calling it, this is to avoid calls to address with no code that will always return succes = true. For exemple if you use token.safeTransfer and...

The _verifyTime function only reverts if revertOnInvalid is true and the order is not active.

Lines of code Vulnerability details Impact The verifyTime function only reverts if revertOnInvalid is true and the order is not active. This means that if revertOnInvalid is not passed or is false, the function will not revert even if the order is not active. It could have a significant impact on...

Reentrancy Vulnerability in _performFinalChecksAndExecuteOrders function

Lines of code Vulnerability details Impact bytes memory accumulator = new bytesAccumulatorDisarmed; and transferitem, execution.offerer, execution.conduitKey, accumulator; The code uses an "accumulator" variable that is used in the transfer function. The accumulator is created using the line byte...

Insecure Cryptography

ujson is vulnerable to insecure cryptography. The vulnerability exists in a JSON string contains escaped surrogate characters which are not part of a proper surrogate pair, the library may decode those characters incorrectly which allows remote attackers to cause unintended behavior in the...

Log Injection

org.apache.sling:org.apache.sling.api and org.apache.sling:org.apache.sling.commons.log is vulnerable to log injection. A remote attacker with privileges to forge logs, is able to inject fake logs and potentially corrupt log files, causing unintended behavior in the the system...

Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate

Impact Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way. Patches The issues were fixed in the 4.11.1 release. The following commits are addressing it: 35d59f1f040541c358cece0a8d4a63183ca919b8...

Business Logic Errors in pimcore

In pimcore versions prior to 10.2.9 discounts could be negative resulting in unintended behavior...

Vault.withdrawRedundant() allows the owner to accidentally take out the vault's whole balance

Handle Ruhum Vulnerability details Impact The Vault.withdrawRedundant allows the owner to withdraw funds that are not accounted for. The function has a check that is supposed to stop the owner from withdrawing funds of the vault's underlying token that the vault "knows" about. But, there's an edg...

Risk of memory overflow

Handle 0xsanson Vulnerability details Impact It's possible to overflow the memory in multiple points in the contract, for example by having a long list of tokens and weights: function settleAuction uint256 memory bountyIDs, address memory inputTokens, uint256 memory inputWeights, address memory...