2804 matches found
config-validator:fuzz_config_validator: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=4782519362387968 Project: config-validator Fuzzing Engine: libFuzzer Fuzz Target: fuzzconfigvalidator Job Type: libfuzzerasanconfig-validator Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000033fcc899 Crash State: NULL Sanitizer:...
Malicious operators within epoch can not be manually invalidated
Lines of code Vulnerability details Impact Messages are verified and validated by a set of operators. Operators their weights and threshold are defined per epoch and stored as a hash. Transferring operatorship which means creating a new set of valid operators creates a new epoch. Operator sets th...
Malicious relayer can execute stale transactions by spoofing validator weights/threshold in proof
Lines of code Vulnerability details Impact Transaction is submit with wrong validator information, allowing stale commands to be executed Proof of Concept This vulnerability is a result of allowing msg.sender to provide key information identifying operators. First we need to understand how the...
CVE-2022-24912
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an...
CVE-2022-24912
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an...
CVE-2022-24912 Timing Attack
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an...
CVE-2022-24912
The vulnerability is in github.com/runatlantis/atlantis/server/controllers/events (pre-0.19.7) where webhook secret validation uses a non-constant-time comparison, enabling timing attacks to recover the secret and forge webhook events. This aligns with CVE-2022-24912 and related advisories. Impac...
CVE-2022-24912
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an...
config-validator:fuzz_config_validator: Segv on unknown address with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=4910576756719616 Project: config-validator Fuzzing Engine: libFuzzer Fuzz Target: fuzzconfigvalidator Job Type: libfuzzerasanconfig-validator Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: addre...
CVE-2022-24912: Observable Discrepancy
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an...
Fedora: Security Advisory for golang-github-mattermost-xml-roundtrip-validator (FEDORA-2022-3969b64d4b)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Popular NFT Marketplace Phished for $540M
Axie Infinity, a popular destination for 3 million traders of in-game collectible non-fungible tokens, reportedly lost $540M in cryptocurrency in a recruiting-themed spear phishing attack. The perpetrators of the crime are believed to be an advanced persistent threat group with ties to North...
Fake job offer leads to $600 million theft
Back in March, popular NFT battler Axie Infinity lay at the heart of a huge cryptocurrency theft inflicted on the Ronin network. From the Ronin newsletter: There has been a security breach on the Ronin Network. Earlier today, we discovered that on March 23rd, Sky Mavis’s Ronin validator nodes and...
django: Denial-of-service possibility in UserAttributeSimilarityValidator
A resource-consumption flaw was found in django's UserAttributeSimilarityValidator, where it incurred significant overhead evaluating any submitted password that was artificially large relative to comparison values. A network attacker could exploit this flaw to cause a denial of service...
Security Bulletin: Due to use of Hibernate Validator version 6.1.2.Final IBM Tivoli Network Manager is vulnerable which allows attackers to bypass input sanitation (escaping, stripping) controls(CVE-2020-10693, CVE-2019-10219).
Summary A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put i...
scniro-validator denial of service vulnerability
scniro-validator is a small, dependency-free email validator. scniro-validator version v1.0.1 contains a denial of service vulnerability that stems from a failure to properly handle crafted invalid emails when validating them, which could be exploited by an attacker to cause a denial of service o...
Regular Expression Denial Of Service (ReDoS)
scniro-validator is vulnerable to regular expression denial of service. The vulnerability exists due to a lack of input validation which allows an attacker to crash the system via maliciously crafted email...
CVE-2021-40901
A Regular Expression Denial of Service ReDOS vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails...
