Malicious code in cap-products (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6668a5db157ab80fd832c57ce2d16ac376f579efa41da56fc5c07b89ef822cb2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cap-common-pages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 954caac36d992b5cdce1a85a0430ce34d611445215299bec5e095248a1797338 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the fribidi_cap_rtl_to_unicode function in the GNU FriBidi library allows a perpetrator to execute arbitrary code.

The vulnerability of the fribidicaprtltounicode function in the GNU FriBidi library arises due to a buffer overflow in the dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

cap-genealogie.com Cross Site Scripting vulnerability OBB-2526380

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

UBUNTU-CVE-2022-25309

A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidicaprtltounicode function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and...

cap-sciences.net Cross Site Scripting vulnerability OBB-2339571

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

rong comment in getFee

Handle cmichel Vulnerability details The ThreePieceWiseLinearPriceCurve.getFee comment states that the total + the input must be less than the cap: If dollarCap == 0, then it is not capped. Otherwise, then the total + the total input must be less than the cap. The code only checks if the input is...

PT-2022-2352 · Fribidi +10 · Fribidi +10

Name of the Vulnerable Software and Affected Versions: Fribidi affected versions not specified Description: A heap-based buffer overflow flaw was found in the Fribidi package, affecting the fribidi cap rtl to unicode function. This flaw allows an attacker to pass a specially crafted file to the...

Basket's max cap can be surpassed due to beneficiary entry fee

Handle kenzo Vulnerability details When joining a basket, the function verifies that the total supply + tokens the user asks to mint is smaller than the basket's max supply. However, this doesn't take into account the fact that additional tokens will be minted if there's an entry fee beneficiary...

BasketFacet.sol#joinPool() feeAmount should be considered when checking MAX_POOL_CAP_REACHED

Handle WatchPug Vulnerability details require totalSupply.addamount = this.getCap, "MAXPOOLCAPREACHED" ; uint256 feeAmount = amount.mulbs.entryFee.div1018; feeAmount should be considered. Otherwise, the new totalSupply may surpass pool cap. --- The text was updated successfully, but these errors...

jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

Missing cap on LicenseFee

Handle gzeon Vulnerability details Impact There is no cap on LicenseFee. While change of LicenseFee is under 1 day timelock, introducing a maxLicenseFee can improve credibility by removing the "rug" vector. There is a minLicenseFee in the contracts, while imo make little sense to have minLicenseF...

OverlayV1UniswapV3Market computes wrong market liquidity

Handle cmichel Vulnerability details The OverlayV1UniswapV3Market.fetchPricePoint tries to compute the market depth in OVL terms as marketLiquidity in ETH / ovlPrice in ETH per OVL. To get the market liquidity in ETH and not the other token pair, it uses the ethIs0 boolean. marketLiquidity = ethI...

The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.

...

Controller.setCap sets wrong vault balance

Handle cmichel Vulnerability details The Controller.setCap function sets a cap for a strategy and withdraws any excess amounts diff. The vault balance is decreased by the entire strategy balance instead of by this diff: // @audit why not sub diff? vaultDetailsvault.balance =...

OracleManagerFlippening_V0 wrong decimals

Handle cmichel Vulnerability details The OracleManagerFlippeningV0.updatePrice function states that it wants to return the eth dominance as a percentage where 100% = 1e20. It's unclear why there is a division by 1e10 to compute the bitcoin market cap: uint256btcPrice btcSupply 1e10 Impact The pri...

CVE-2021-22240

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled...

CVE-2021-22240

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled...

CVE-2021-22240

Removed by vendor...

PT-2021-6695 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 Description: The issue is related to improper authorization in GitLab, allowing a remote attacker to impact data integrity. It is also described as an improper access control issue, enabling use...