All swapping functions lack checks for returned tokens

Lines of code Vulnerability details Impact Every function that stems from the GenericSwapFacet lacks checks to ensure that some tokens have been returned via the swaps. In LibSwap.sol in the swap function, the swap call is sent to the target DEX. A return of success is required, otherwise the...

Security Bulletin: Cross Site Scripting may affect IBM Business Automation Workflow and IBM Case Manager (ICM) - CVE-2020-4768

Summary IBM Case Manager and IBM Business Automation Workflow may be vulnerable to a cross site scripting attack. Vulnerability Details CVEID: CVE-2020-4768 DESCRIPTION: IBM Case Manager and IBM Business Automation Workflow are vulnerable to cross-site scripting. This vulnerability allows users t...

GSD-2022-1000918 xen/xenbus: don't let xenbus_grant_ring() remove grants in error case

xen/xenbus: don't let xenbusgrantring remove grants in error case This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.271 by commit...

GSD-2022-1000687 xen/xenbus: don't let xenbus_grant_ring() remove grants in error case

xen/xenbus: don't let xenbusgrantring remove grants in error case This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.14 by commit...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Case Manager (CVE-2021-23450)

Summary IBM WebSphere Application Server is shipped as a component of IBM Case Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

CVE-2021-20299

creationtimestamp| type| source ---|---|--- 2022-03-16 17:33:58+00:00| seen| https://t.me/cibsecurity/39086...

Frontrunning of setPerTokenWalletCap edge case

Lines of code Vulnerability details Impact The setPerTokenWalletCap function in WhitelistPeriodManager.sol contains a comment stating: Special care must be taken when calling this function There are no checks for perTokenWalletCap since it's onlyOwner, but it's essential that it should be = max l...

CVE-2022-24578

creationtimestamp| type| source ---|---|--- 2022-03-14 21:18:24+00:00| seen| https://t.me/cibsecurity/38903...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Case Manager (CVE-2021-39038)

Summary IBM WebSphere Application Server is shipped as a component of IBM Case Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID: CVE-2021-39038 DESCRIPTION: IBM WebSphere Applicati...

GSD-2022-1000495 scsi: myrs: Fix crash in error case

scsi: myrs: Fix crash in error case This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.10 by commit 1d6cd26605b4d662063a83c15c776b5299a1cb23...

GSD-2022-1000420 scsi: myrs: Fix crash in error case

scsi: myrs: Fix crash in error case This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.24 by commit 6207f35c213f6cb2fc3f13b5e77f08c710e1de19...

GSD-2022-1000366 scsi: myrs: Fix crash in error case

scsi: myrs: Fix crash in error case This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.101 by commit 0e42c4a3d732517edc3766dd45a14e60d29dd929...

GSD-2022-1000335 scsi: myrs: Fix crash in error case

scsi: myrs: Fix crash in error case This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.180 by commit 5c5ceea00c8c9df150708e66cb9f2891192c1162...

CVE-2022-23652

creationtimestamp| type| source ---|---|--- 2022-02-22 22:12:47+00:00| seen| https://t.me/cibsecurity/37902...

Authorization Bypass

urijs is vulnerable to Authorization Bypass. The vulnerability exists in the User-Controlled Key due to the case-sensitive checks which not properly configured, allowing an attacker to bypass and gain access...

CVE-2022-0613

A flaw was found in urijs due to the fix of CVE-2021-3647 not considering case-sensitive protocol schemes in the URL. This issue allows attackers to bypass the patch...

PT-2022-13299 · Uri.Js · Uri.Js

Name of the Vulnerable Software and Affected Versions: urijs versions prior to 1.19.8 Description: The issue allows an attacker to bypass authorization through a user-controlled key. Specifically, it is possible to use case-insensitive protocol schemes, such as HTTP, htTP, HTtp, etc., to bypass...

in medialize/uri.js

Description Bypass for https://huntr.dev/bounties/1625558772840-medialize/URI.js/ urijs fixed the issue for CVE-2021-3647, however an attacker can still exploit the issue due to case-sensitive checks in the earlier patch. Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp et...

CVE-2021-37109

creationtimestamp| type| source ---|---|--- 2022-02-10 02:19:21+00:00| seen| https://t.me/cibsecurity/37160...

Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers

A vulnerability was found in all versions of the deprecated package Keycloak Gatekeeper, where on using lower case HTTP headers via cURL we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers e.g. Jetty. This means there is no protection when we put a Gatekeeper in...