Sandbox Bypass

Jenkins Script Security Plugin is vulnerable to Sandbox Bypass. The vulnerability exists during the casting of array-like values to array types that intercepts per-element casts which allows an attacker to bypass sandbox restrictions and execute arbitrary codes...

Jenkins Script Security Plugin sandbox bypass vulnerability

A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b0b0aa451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary...

PT-2022-26887 · Jenkins · Jenkins Script Security Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Script Security Plugin versions 1183.v774b 0b 0a a 451 and earlier Description: A sandbox bypass issue involves casting an array-like value to an array type, allowing attackers with permission to define and run sandboxed scripts,...

ellenjacobycasting.com Cross Site Scripting vulnerability OBB-2997882

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

founderPct variable cast

Lines of code Vulnerability details Description There is a function addFounders in Token contract. It accepts array of FounderParams as an input. For each of founders it uses founderPct as an variable to store percent ownership for such founder. It is unsafe to cast it to from uint256 to uint8 in...

createLock: User can lose funds by sending a wrong _value parameter

Lines of code Vulnerability details Impact Users can lose funds by sending a wrong value parameter. The problems relays in casting value to int128. Solidity does not check casting, just math operations. If a user tries to lock an amount greater than 2^128, the transaction won't be reverted and...

Unsafe casting from int128 can cause wrong accounting of locked amounts

Lines of code Vulnerability details Impact The unsafe casting to int128 variable can cause its value to be different from the correct value. For example in the createLock function, the addition to the locked amount variable is done by locked.amount += int128int256value. In that case, if value is...

Unsafe typecasting can lead to tokens being locked in the contract

Lines of code Vulnerability details Impact In the createLock function the amount is calculated by casting the uint256 value to int128 in an unsafe way. Specifically the locked.amount is calculated as: locked.amount += int128int256value; could result in a negative value for locked.amount. For...

casting-marleneschmidt.de Cross Site Scripting vulnerability OBB-2802884

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

casting-power.de Cross Site Scripting vulnerability OBB-2802879

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Possible casting overflow in _updateAccounting function

Lines of code Vulnerability details Impact In the updateAccounting function, the inkOut and artIn parameters are cast from type uint256 to uint128. However, since the explicit cast does not ensure the value fits the uint128 data type i.e., not ensuring value = typeuint128.max, casting overflows a...

CVE-2022-21786

In audio DSP, there is a possible memory corruption due to improper casting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558822; Issue ID: ALPS06558822...

CVE-2022-21786

In audio DSP, there is a possible memory corruption due to improper casting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558822; Issue ID: ALPS06558822...

PT-2022-15127

Name of the Vulnerable Software and Affected Versions Audio DSP affected versions not specified Description The issue is related to a possible memory corruption in audio DSP due to improper casting. This could lead to local escalation of privilege, with System execution privileges needed. User...

Upgraded Q -> M from 150 [1656258796240]

Judge has assessed an item in Issue 150 as Medium risk. The relevant finding follows: Unsafe casting may overflow SafeMath and Solidity 0.8. handles overflows for basic math operations but not for casting. Consider using OpenZeppelin's SafeCast library to prevent unexpected overflows when casting...

Design/Logic Flaw

All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service DoS when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. Note: pg-native is a mere binding to npm's libpq library, which in...

[WP-H0] Unsafe type casting for the order's denominator and numerator may allow the attacker to buy more than the offered amount from the seller against the seller's will

Lines of code Vulnerability details orderStatusorderHash.numerator = uint120 filledNumerator + numerator ; orderStatusorderHash.denominator = uint120denominator; When an order is filled partially, the order's denominator and numerator will be updated in...

Fulfilling an order more than once

Lines of code Vulnerability details Impact Any non basic or FULL order can be fulfilled more than once, assuming the offerer has approved the contract the right amounts. This is a valid assumption as users may max-approve the contract/conduits, or have multiple orders with the same items open so...

Casting overflow when updating the status of partially fulfilled orders

Lines of code Vulnerability details Impact In the validateOrderAndUpdateStatus function of OrderValidator, the numerator and denominator of the order status are cast from type uint256 to uint120. However, since the explicit cast does not ensure the value fits the uint120 data type i.e., not...

UBUNTU-CVE-2022-29181

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors segfault or reads from unrelated memory. Version 1.13.6...