14646 matches found
GSD-2022-1002840 scsi: lpfc: Fix call trace observed during I/O with CMF enabled
scsi: lpfc: Fix call trace observed during I/O with CMF enabled This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.3 by commit...
Today is the last day to submit to the SpringOne 2022 Call For Papers!
Hi, Spring fans! This year, SpringOne is back in person, and being held in my hometown of San Francisco, California, December 6th-8th. Have you registered? and today June 28th, 2022 is the last day to submit to the Call For Papers! If you have a good idea or story you want to share, submit today!...
HPE Version Control Repository Manager Elevation of Privilege Vulnerability
HPE Version Control Repository Manager is a version control repository manager from Wise and Technology HPE. An elevation of privilege vulnerability exists in HPE Version Control Repository Manager versions prior to 7.6.14.0, which stems from an incorrectly programmed call to an advanced local...
Functions in the BatchRequests contract revert for removed contract addresses
Lines of code Vulnerability details Impact Removing Yieldy contract addresses from the contracts array with BatchRequests.removeAddress replaces the contract address with a zero-address due to how delete works. Each function that loops over the contracts array or accesses an array item by index,...
Unused Return
Lines of code Vulnerability details Impact Configuration Check: unused-return Severity: Medium Confidence: Medium Description: The return value of this external call is not stored in a local or state variable. Unused return values of function calls are indicative of programmer errors which may ha...
instead of call() , transfer() is used to withdraw the ether
Lines of code Vulnerability details Impact To withdraw eth it uses transfer, this trnansaction will fail inevitably when : - The withdrwer smart contract does not implement a payable function. Withdrawer smart contract does implement a payable fallback which uses more than 2300 gas unit Thw...
Redeemer.sol#redeem() can be called by anyone before maturity, which may lead to loss of user funds
Lines of code Vulnerability details function redeem uint8 p, address u, uint256 m public returns bool // Get the principal token that is being redeemed by the user address principal = IMarketPlacemarketPlace.marketsu, m, p; // Make sure we have the correct principal if p !=...
HPE Version Control Repository Manager 安全漏洞
HPE Version Control Repository Manager is a version control repository manager from Wise and Technology HPE. An elevation of privilege vulnerability exists in HPE Version Control Repository Manager versions prior to 7.6.14.0, which stems from an incorrectly programmed call to an advanced local...
REENTRANCY-Avoid transfer() as reentrancy mitigations. Transfer do not protect from reentrancies in case of gas price changes.
Lines of code Vulnerability details Impact --Check: reentrancy-unlimited-gas --Severity: Informational --Confidence: Medium Transfer and send have been recommended as a security best-practice to prevent reentrancy attacks because they only forward 2300 gas. That being said, gas repricing of...
Dial 311 for… cybersecurity emergencies?
Members of the Cybersecurity Advisory Committee of CISA Cybersecurity and Infrastructure Security Agency have proposed an emergency cybersecurity call line for small and medium-sized businesses SMBs. Should the proposition be approved, SMBs would be able to call 311 in the event of a cybersecurit...
MAL-2022-3986 Malicious code in iv-api-call-tracker (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b385feaf487d9c09c11277be1320cad3f84fedf26c5d42f9483a3935a049b98 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in iv-api-call-tracker (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b385feaf487d9c09c11277be1320cad3f84fedf26c5d42f9483a3935a049b98 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Upgraded Q -> M from 135 [1655579793739]
Judge has assessed an item in Issue 135 as Medium risk. The relevant finding follows: L send is not recommended for sending native token Since the introduction of transfer, it has typically been recommended by the security community because it helps guard against reentrancy attacks. This guidance...
Upgraded Q -> M from 117 [1655579798819]
Judge has assessed an item in Issue 117 as Medium risk. The relevant finding follows: Don't use send / transfer to send ETH This is low severity but you should avoid these and use call --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 119 [1655579861612]
Judge has assessed an item in Issue 119 as Medium risk. The relevant finding follows: L01: Use .call instead of .send Line References Description It is recommended to use call instead of send because the former fowards all remaining gas with the call, while the latter has a gas limit of 2300. Thi...
Low Value Definition On The Slippage
Lines of code Vulnerability details Impact Trades can happen at a bad price and lead to receiving fewer tokens than at a fair market price. The attacker's profit is the protocol's loss. Proof of Concept MyStrategy contract has low slippage checks which can lead to being vulnerable to sandwich...
Apache Hadoop Elevation of Privilege Vulnerability (CNVD-2022-51055)
Apache Hadoop is an open source distributed systems infrastructure from the Apache Foundation. The product is capable of distributed processing of large amounts of data and is highly reliable, scalable, and fault-tolerant. an elevation of privilege vulnerability exists in Apache Hadoop, which ste...
BitTorrent uTorrent 安全漏洞
BitTorrent uTorrent is a suite of BitTorrent client software written in C++ by the American company BitTorrent. A security vulnerability exists in BitTorrent uTorrent that stems from some unknown functionality of the component JSON RPC server. A remote attacker could exploit the vulnerability to...
GHSA-PMCV-MGCF-RVXG Non-aligned u32 read in Chacha20 encryption and decryption
The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to std::slice::fromrawpartsmut, which breaks the contract and introduces undefined behavior. This affects Chacha20 encryption and decryption in crypto2...