PT-2022-11169

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to an incorrect buffer size calculation in the video framework. Successful exploitation of this issue can affect availability. There ...

CVE-2021-40048: Incorrect Calculation of Buffer Size

There is an incorrect buffer size calculation vulnerability in the video framework. Successful exploitation of this vulnerability will affect availability...

PT-2022-28915

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.16 through v5.16.5 Description The issue is related to a wrong calculation of the header index in HW GRO. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

getFeePercentageForSafe may send lower fees

Lines of code Vulnerability details Impact May cause lower fees to be calculated Proof of Concept 1. customFeePercentageForSafe = 100 2. customFeePercentageForCollateral = 200 3. slurp gets call which calls getFeePercentageForSafe as part of its interest calculation 4. getFeePercentageForSafe wil...

unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c

A flaw was found in unbound. An integer overflow in dnscloadlocaldata function may lead to a buffer overflow of the allocated buffer if the size can be controlled by an attacker. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability...

no back up action if price oracle fails

Lines of code Vulnerability details Impact In ThecosomataETH.sol the calculateAmountRequiredForLP function makes calculations based on the price fetched from a curvepool oracle. There is no back up action if the price returned is 0 or if the oracle fails. This could result in false calculations i...

Denial Of Service (DoS)

github.com/open-policy-agent/opa, is vulnerable to denial of service DoS. The vulnerability exists due to Incorrect calculation in defaultLocation function in format.go file allowing an attacker to crash the system...

GHSA-9GWQ-6CWJ-47H3 Integer overflow in TFLite array creation

Impact An attacker can craft a TFLite model that would cause an integer overflow in TfLiteIntArrayCreate: cc TfLiteIntArray TfLiteIntArrayCreateint size int allocsize = TfLiteIntArrayGetSizeInBytessize; // ... TfLiteIntArray ret = TfLiteIntArraymallocallocsize; // ... The...

Block miscalculations

Lines of code Vulnerability details Impact The updatePool function in MasterChef is supposed to account for all blocks before endBlock. But the if statement checks if the current block is after the deadline. Thus blocks between pool.lastRewardBlock and endBlock won't be accounted for iff...

[WP-H8] ConvexStakingWrapper.sol#_calcRewardIntegral Wrong implementation can disrupt rewards calculation and distribution

Lines of code Vulnerability details uint256 bal = IERC20reward.token.balanceOfaddressthis; uint256 dreward = bal - reward.remaining; // send 20 % of cvx / crv reward to treasury if reward.token == cvx || reward.token == crv IERC20reward.token.transfertreasury, dreward / 5; dreward = dreward 4 / 5...

PYSEC-2022-140

Tensorflow is an Open Source Machine Learning Framework. The implementation of OpLevelCostEstimator::CalculateOutputSize is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements. We can have a large enough number ...

PYSEC-2022-122

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in TfLiteIntArrayCreate. The TfLiteIntArrayGetSizeInBytes returns an int instead of a sizet. An attacker can control model inputs such that computedsize overflows the...

CVE-2022-23576 Integer overflow in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. The implementation of OpLevelCostEstimator::CalculateOutputSize is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements. We can have a large enough number ...

user won't be able to get his rewards in case of staking with amount = 0

Handle CertoraInc Vulnerability details Limbo.sol stake function if a user has a pending reward and he call the stake function with amount = 0, he won't be able to get his reward he won't get the reward, and the reward debt will cover the reward that's happening because the reward calculation is...

MINTING to collateralVault could inflating totalsupply, without giving the balance to anyone

Handle Tomio Vulnerability details Impact First of all, this is an address zero issue, however, this could lead to an imbalance between total supply circulating and the actual balance that was assigned to another user, in the...

ConvexStakingWrapper does not update rewards state before transferring tokens

Handle kenzo Vulnerability details ConvexStakingWrapper saves data for reward calculation in dedicated variables for each user, such as reward.rewardintegralforaccount. These variables are not updated when transferring wrapped staked tokens. Please note that Convex's original ConvexStakingWrapper...

GHSA-XWQR-XMGG-J69Q Integer overflow in solana_rbpf

From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.stvalue is read directly from ELF file without checking. If the sym.stvalue is rather large, an integer overflow is triggered while calculating the variable "addr"...

Mageia: Security Advisory (MGASA-2022-0035)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

addressShare is not updated on arbRestake

Handle hack3r-0m Vulnerability details when intialStake is called, it mints the nft, and on before transfer hook, addressSharesmsg.sender is credited with minted shares when redeemNFT is called, it burns the nft, and on before transfer hook, addressSharesmsg.sender is subtracted with burned share...

Zero value shown for stake & price in SherBuy.viewCapitalRequirements() when SherAmount between 1~1000 SherTokens.

Handle 0xwags Vulnerability details Impact stakeusdc staked and priceusdc to be paid will display zerowhen SherAmt is between one - four digit for eg, 1-1000if SHERDECIMALS is used as the divisor. I'm sure there is no limitation on the amount of Sher that one can buy or is it that there should be...