Using block.timestamp as the deadline/expiry invites MEV

Lines of code 307 Vulnerability details Passing block.timestamp as the expiry/deadline of an operation does not mean "require immediate execution" - it means "whatever block this transaction appears in, I'm comfortable with that block's timestamp". Providing this value means that a malicious mine...

Using block.timestamp as the deadline/expiry invites MEV

Lines of code 307 Vulnerability details Passing block.timestamp as the expiry/deadline of an operation does not mean "require immediate execution" - it means "whatever block this transaction appears in, I'm comfortable with that block's timestamp". Providing this value means that a malicious mine...

Using block.timestamp as the deadline/expiry invites MEV

Lines of code 307 Vulnerability details Impact Passing block.timestamp as the expiry/deadline of an operation does not mean "require immediate execution" - it means "whatever block this transaction appears in, I'm comfortable with that block's timestamp". Providing this value means that a malicio...

nodejs security update

1:16.19.1-2 - Update bundled c-ares to 1.19.1 Resolves: CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-32067 1:16.19.1-1 - Rebase to 16.19.1 - Resolves: rhbz2153714 - Resolves: CVE-2023-23918 CVE-2023-23919 CVE-2023-23936 CVE-2023-24807 CVE-2023-23920 - Resolves: CVE-2022-25881 CVE-2022-49...

nodejs and nodejs-nodemon security and bug fix update

nodejs 16.16.0-1 - Rebase to version 16.16.0 Resolves: RHBZ2106290 Resolves: CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215 16.14.0-5 - Decouple dependency bundling from bootstrapping nodejs-nodemon...

nodejs:14 security and bug fix update

nodejs 1:14.20.0-2 - Replace with macros with RPM confitionals - Unify configure calls into single command - Refactor bootstrap-related parts - Decouple dependency bundling from bootstrapping - Resolves: RHBZ2111417 1:14.20.0-1 - Rebase to latest version - Resolves: RHBZ2106367 - CVE fixes for...

Malicious Package

Overview rblxtools is a malicious package. This is one of 12 malicious packages created by the same actor and discovered by Snyk. It downloads and executes malicious exe files containing malicious code that attempts to steal information from Google Chrome, tokens from Discord, and Injects a Disco...

CVE-2018-6058

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-11215. Reason: This candidate is a reservation duplicate of CVE-2017-11215. Notes: All CVE users should reference CVE-2017-11215 instead of this candidate. All references and descriptions in this candidate have been removed t...

7.13: Upgrade Confluence to latest Adopt OpenJDK versions 11.0.12

This issue includes running tests against JDK 11 latest11.0.127 and also bundling this JDK in installer...

7.13: Upgrade Confluence to latest Adopt OpenJDK versions 11.0.12

This issue includes running tests against JDK 11 latest11.0.127 and also bundling this JDK in installer...

Mobile Adware Booms, Online Banks Become Prime Target for Attacks

Hackers painted a bullseye on the backs of online financial institutions in 2020 as the pandemic shuttered local branch offices and forced customers online. Over the past 12 months, incidents of adware nearly tripled. And, overall in 2020 researchers saw a slight drop in the number of mobile...

CVE-2018-17205

An issue was discovered in Open vSwitch OvS, 2.7.x through 2.7.6, 2.8.x through 2.8.4, and 2.9.x through 2.9.2, where the ofprotoruleinsert function inside ofproto/ofproto.c is affected by an assertion failure under certain circumstances. A specially crafted flow update applied using the bundling...

unixODBC security update

2.3.1-14.0.1 - backport unchecked malloc memory references fix Orabug: 29684195 2.3.1-14 - fixed insecure buffer copy 1571530 - fixed possible buffer overflow 1571528 2.3.1-13 - revert: ltdl bundling 2.3.1-12 - fix the libtool-ltdl compatibility Resolves: rhbz1267438...

openvswitch: Error during bundle commit in ofproto/ofproto.c:ofproto_rule_insert__() allows for crash

An issue was discovered in Open vSwitch OvS, 2.7.x through 2.7.6, 2.8.x through 2.8.4, and 2.9.x through 2.9.2, where the ofprotoruleinsert function inside ofproto/ofproto.c is affected by an assertion failure under certain circumstances. A specially crafted flow update applied using the bundling...

openvswitch: Error during bundle commit in ofproto/ofproto.c:ofproto_rule_insert__() allows for crash

An issue was discovered in Open vSwitch OvS, 2.7.x through 2.7.6, 2.8.x through 2.8.4, and 2.9.x through 2.9.2, where the ofprotoruleinsert function inside ofproto/ofproto.c is affected by an assertion failure under certain circumstances. A specially crafted flow update applied using the bundling...

openvswitch: Error during bundle commit in ofproto/ofproto.c:ofproto_rule_insert__() allows for crash

An issue was discovered in Open vSwitch OvS, 2.7.x through 2.7.6, 2.8.x through 2.8.4, and 2.9.x through 2.9.2, where the ofprotoruleinsert function inside ofproto/ofproto.c is affected by an assertion failure under certain circumstances. A specially crafted flow update applied using the bundling...

WordPress Plugin Slider Templatic Tevolution < 2.3.6 - Arbitrary File Upload

Exploit Title: WordPress Templatic = 2.3.6 Tevolution File Upload Vulnerability Date: 30-12-2016 Software Link: Permium plugin Vendor Homepage: https://templatic.com/wordpress-plugins/tevolution Exploit Author: r3m1ck Website: https://www.r3m1ck.us/ Category: webapps Google Dork:...

HawtJNI: predictable temporary file name leading to local arbitrary code execution

The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJN...

HawtJNI: predictable temporary file name leading to local arbitrary code execution

The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJN...

Cnet Apologizes for Nmap Adware Bundling

Officials at Cnet’s Download.com site have issued a statement apologizing for bundling the popular open source Nmap security audit application with adware that changed users’ search engine and home page to Microsoft properties. Fyodor, the author of Nmap, raised the issue earlier this week, sayin...