Use of deprecated Chainlink API

Handle 0xRajeev Vulnerability details Impact The contracts use Chainlink’s deprecated API latestAnswer. Such functions might suddenly stop working if Chainlink stopped supporting deprecated APIs. Impact: Deprecated API stops working. Prices cannot be obtained. Protocol stops and contracts have to...

Logic error in fee subtraction

Handle 0xsanson Vulnerability details Impact In LibBalances.applyTrade we need to collect a fee from the trade. The current code however subtracts a fee from the short position and adds it to the long. The correct implementation is to subtract a fee to both see TracerPerpetualSwaps.solL272. This...

Software composition analysis 101

Open source is everywhere. Learn how software composition analysis can automate open source management to secure your applications...

What is Penetration Testing❓ Definition, Stages, Techniques, Pros and Cons

The general concept is that penetration testing, frequently known as upright hacking, separates network security weaknesses by mimicking endeavors to penetrate protections. If it’s anything but, a real aggressor may exploit similar imperfections. Pen testing may manage a creation system or one...

REvil Ransomware Code Ripped Off by Rivals

They say imitation is the sincerest form of flattery: The LV ransomware, a strain that cropped up just this spring, turns out to be based on what is most likely pirated REvil ransomware code, according to researchers. A malware analysis of LV from Secureworks Counter Threat Unit CTU found that it...

Unused return value from Transfer()/ TransferFrom()

Handle JMukesh Vulnerability details Impact return value from transfer/ transferFrom confirm the success of that function call, these return should be checked Proof of Concept Tools Used Manual analysis Recommended Mitigation Steps utilise the return value to check the success of the function ---...

The vulnerability of the application for 3D modeling and Paint 3D printing relates to the execution of operations beyond the buffer boundaries in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the application for 3D modeling and Paint 3D printing is related to the execution of operations beyond the buffer in memory during the syntactic analysis of GLB and STL files. Exploiting this vulnerability allows a attacker to execute arbitrary code using a specially created...

The vulnerability of the application for 3D modeling and Paint 3D printing relates to the execution of operations beyond the buffer boundaries in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the application for 3D modeling and Paint 3D printing is related to the execution of operations beyond the buffer in memory during PLY file syntax analysis. Exploiting this vulnerability allows a attacker to execute arbitrary code using a specially created malware file or a...

Attack Surface Analysis Part 3: Red and Purple Teaming

Part 3: Red and Purple Teaming This is the third and final installment in our 2021 series around attack surface analysis. In part 1 I offered a description and the value and challenge of vulnerability assessment. Part 2 explored the why and how of conducting penetration testing and gave some tips...

Responsive Tourism Website 3.1 Remote Code Execution

Exploit Title: Responsive Tourism Website 3.1 - Remote Code Execution RCE Unauthenticated Date: 22.06.2021 Exploit Author: Tagoletta Tağmaç Software Link: https://www.sourcecodester.com/php/14838/simple-responsive-tourism-website-using-php-free-source-code.html Version: V 3.1 Tested on: MacOS &...

[SECURITY] Fedora 34 Update: radare2-5.3.1-1.fc34

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

[SECURITY] Fedora 33 Update: radare2-5.3.1-1.fc33

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

Lessons Learned from 100 Data Breaches: Part 4, Trends in Average Volumes of Stolen Records

Imperva research shows an increase in the volume of data stolen every year. In 2020, we started to see more and more breaches that exfiltrate records in billions. Based on the analysis of thousands of data breach details published on dbdigest, we made calculations on the raw data and found some...

pentest-wiki

This is a collection of information gathering tools and techniques for penetration testing and security research. The repository contains various scripts and documentation for gathering information about a target organization, including IP analysis, whois analysis, and social media research. The...

Missing call to removeUserFromOrderbook after user is foreclosed

Handle 0xRajeev Vulnerability details Impact Orderbook’s removeUserFromOrderbook is used to delete/remove user’s bids when they are deemed foreclosed. This is called in Market newRental and Treasury withdrawDeposit when users are determined to be foreclosed given their deposit and bid situation...

Attack Surface Analysis Part 2: Penetration Testing

In this three-part series, we’ll explore key considerations and strategies for choosing an attack surface analysis strategy, and the ways it can be used to increase awareness of both technical and process-related risks. This is the second installment in our 2021 series around attack surface...

SAP Solution Manager 7.2 (ST 720) Open Redirection

Onapsis Security Advisory 2021-0005: SAP Solution Manager Open Redirect from Trace Analysis Impact on Business Under certain circumstances, an attacker might be able to steal a cookie from the application. It may impact the confidentiality of the service. Advisory Information - Public Release Dat...

pyWhat - Identify Anything. Easily Lets You Identify Emails, IP Addresses, And More...

The easiest way to identify anything pip3 install pywhat && pywhat --help What is this? Imagine this: You come across some mysterious text 5f4dcc3b5aa765d61d8327deb882cf99 and you wonder what it is. What do you do? Well, with what all you have to do is ask what "5f4dcc3b5aa765d61d8327deb882cf99"...

Trend Micro and JC3 Study on Fraud, Phishing Targeting Japanese Users

This blog details the aspects of two major phishing fraud groups identified from the research and analysis. This study was also announced via separate press releases from Trend Micro Incorporated and JC3...

Zoho ManageEngine Eventlog Analyzer Path Traversal Vulnerability

ZOHO ManageEngine EventLog Analyzer is a system and event log analysis software from ZOHO. A path traversal vulnerability exists in Zoho ManageEngine Eventlog Analyzer 12147 and earlier versions, which is caused by an unauthenticated directory traversal through a ZIP archive entry. An attacker...