Missing support for ERC20 with fee

Lines of code Vulnerability details Impact Contract AaveV3YieldSource allows depositing tokens via supplyTokenTo function. Amount of tokens to transfer is based on passed argument depositAmount and is missing support for tokens with built-in fees. One of the popular tokens that implements such a...

CVE-2021-32976 Moxa NPort IAW5000A-I/O Series Serial Device Server Stack-based Buffer Overflow

Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code...

PT-2022-10168

Name of the Vulnerable Software and Affected Versions Moxa NPort IAW5000A-I/O series firmware versions prior to 2.3 Description The issue allows data to be copied without validation in the built-in web server, potentially enabling a remote attacker to cause denial-of-service conditions...

PT-2022-10167

Name of the Vulnerable Software and Affected Versions Moxa NPort IAW5000A-I/O Series firmware versions prior to 2.3 Description The issue is related to two buffer overflows in the built-in web server, which may allow a remote attacker to cause a denial-of-service condition. Recommendations For...

CVE-2021-32976: Stack-based Buffer Overflow

Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code...

PT-2022-10170

Name of the Vulnerable Software and Affected Versions Moxa NPort IAW5000A-I/O series firmware versions 2.2 or earlier Description The issue is related to five buffer overflows in the built-in web server of the Moxa NPort IAW5000A-I/O series. This may allow a remote attacker to initiate a...

CVE-2021-32974: Improper Input Validation

Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands...

CVE-2021-32968: Buffer Copy without Checking Size of Input

Two buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O Series firmware version 2.2 or earlier may allow a remote attacker to cause a denial-of-service condition...

Opera’s Free Browser VPN Completes Independent Security Audit by Cure53

News Opera’s Free Browser VPN Completes Independent Security Audit by Cure53 Share March 30th, 2022 Today we’re happy to announce the completion of an independent security audit of Opera’s free built-in browser VPN. Opera’s free, no-log, built-in browser VPN was originally launched as part of the...

CVE-2022-27920

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...

libkiwix cross-site scripting vulnerabilities

libkiwix is a common code base for all Kiwix ports. A security vulnerability exists in libkiwix 10.0.0 and 10.0.1 that allows the use of XSS in the built-in web server functionality by searching for suggested URL parameters...

CVE-2022-25364

In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malicious actor with network access to the build cache could potentially populate it with manipulated entries that execute malicious code as par...

PT-2022-17242 · Gradle · Gradle Enterprise

Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions prior to 2021.4.2 Description: The default built-in build cache configuration in Gradle Enterprise allowed anonymous write access, potentially enabling a malicious actor with network access to populate the cache wit...

NETGEAR Router Command Injection

The vulnerability of the embedded software of NETGEAR’s RAX200, RAX75, RAX80, RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 routers lies in the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

NETGEAR Router Command Injection

The vulnerability of the embedded software of NETGEAR RBS50Y, RBR20, RBR40, RBR50, RBS20, RBS40, RBS50, RBK20, RBK40, and RBK50 routers lies in the lack of measures for cleaning input data. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

NETGEAR RAX200 software Data Compromise

The vulnerability of NETGEAR RAX200 router’s built-in software is related to errors in the code. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

NETGEAR Router Command Injection

The vulnerability of the embedded software of NETGEAR routers such as RBR20, RBR40, RBR50, RBS20, RBS40, RBR50, RBK20, RBK40, and RBK50 lies in the lack of measures for cleaning incoming data. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

DEBIAN-CVE-2022-25265

In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 e.g., with GCC 3.2.2 and Linux kernel 2.4.20. This can cause execution of bytes located in supposedly non-executable regions of a file...

CVE-2022-25265

In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 e.g., with GCC 3.2.2 and Linux kernel 2.4.20. This can cause execution of bytes located in supposedly non-executable regions of a file...

GHSA-WR66-VRWM-5G5X Denial of Service Vulnerability in next.js

Impact Vulnerable code could allow a bad actor to trigger a denial of service attack for anyone running a Next.js app at version = 12.0.0, and using i18n functionality. - Affected: All of the following must be true to be affected by this CVE - Next.js versions above v12.0.0 - Using next start or ...