PT-2022-35554 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: The issue is related to a platform-device leak in the bridge platform create function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2025-18529

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak issue has been resolved in the Linux kernel. The problem occurs when the VLAN protocol of a bridge changes, and the bridge driver attempts to delete a VLAN via the 8021q...

PT-2022-35125 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns a platform-device leak in the bridge platform create function. This problem was introduced in version v5.5 and is fixed in Linux Kernel version v6.0.3. The actual impact an...

PT-2022-35346 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: The issue is related to the drm: bridge: adv7511, where the CEC I2C device is not unregistered after the CEC adapter is removed. This problem was introduced in version v4.15 and is fixed in...

PT-2022-35126 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns a platform-device leak in the bridge platform create function. This problem was introduced in version v5.19 and is fixed in Linux Kernel version v6.0.3. The actual impact a...

PT-2022-35608 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.223 Description: The issue is related to memory corruption with too many bridges in the drm/msm/dsi component. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2022-35096 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the drm: bridge: adv7511, where the CEC I2C device is not unregistered after the CEC adapter is removed. This is an automated ID intended to aid in discovery of...

PT-2022-34898 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.7 Description: The issue is related to the addition of atomic check to bridge ops in the drm/msm/dp module. It was introduced in version v5.17 and fixed in version v6.0.7. The actual impact and attack...

PT-2022-35368 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: The issue is related to a platform-device leak in the bridge platform create function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

Funds can be stolen

Lines of code Vulnerability details Impact For L2, any deposit finalization should come from L1 bridge address. Now the MailBox contract is currently helping to simulate such calls to be coming from L1. The problem is if within zkSync ecosystem, a contract is deployed with address same as L1 brid...

Bridge should not allow ERC20 tokens with double-entry point

Lines of code Vulnerability details Impact If a token with double-entry point is escrowed in L1 bridge, the user could withdraw their token through the other entry point, thus rugpulling the bridge. And when they actually withdraw from L2, they will take other users' funds from the bridge. Proof ...

eco-bridge.com Cross Site Scripting vulnerability OBB-3029007

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Dave Jong Patchstack in the WordPress Api2Cart Bridge Connector plugin versions = 1.1.0. Solution Update the WordPress Api2Cart Bridge Connector plugin to the latest available version at least 1.2.0...

Api2Cart Bridge Connector < 1.2.0 - Unauthenticated RCE

The plugin does not validate some parameters which could lead to RCE...

Api2Cart Bridge Connector < 1.2.0 - Unauthenticated Arbitrary File Upload

The plugin does not validate file to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP...

The vulnerability of the Adobe Bridge file manager, related to the use of memory after it is freed, allows a hacker to exploit the protected information.

The vulnerability of the Adobe Bridge file manager is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to disclose protected information using a specially created file...

Information Disclosure

Batik bridge is vulnerable to information disclosure. The vulnerability exists in the function of DefaultScriptSecurity because the jars get loaded by default which allows an attacker to execute arbitrary codes into the system...

If bridge request fails users tokens are burned with no way to recover

Lines of code Vulnerability details Impact Users tokens are still burned at source chain with no way to recover them Proof of Concept try HolographOperatorInterfaceaddressthis.nonRevertingBridgeCallvalue: msg.value msg.sender, bridgeInRequestPayload /// @dev do nothing catch failedJobshash = true...

Any user asset sent through the bridge can be frozen in limbo by a malicious operator.

Lines of code Vulnerability details Operator can fail transactions causing user to lose their send asset, due to incorrect gas check calculation. Line 416 in Operator. If gasleft = gasLimit + small amount, gas reaching nonRevertingBridgeCall will be 63/64 of casleft - CALL opcode code, which is...

Adversary can cause malicious slashing of operators by creating malicous token and setting gas limit above chain block gas limit

Lines of code Vulnerability details Impact Operators maliciously slashed Proof of Concept A user can create a malicious token that when called by anyone other than themselves and the bridge use an extreme amount of gas. They create a bridge request with a gas limit higher than the block limit. If...