Low: Red Hat Security Advisory: redhat-ds:11 security, bug fix, and enhancement update

Red Hat Directory Server 11.4 is now available. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the Reference...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-18217)

MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database designed to guarantee 99.999% availability. An input validation error vulnerability exists in Oracle MySQL Cluster that stems from improper validation of user-supplied data and can be exploited by an attacker to...

PHPMyWind Cross-Site Request Forgery Vulnerability

PHPMyWind is a W3C-compliant website building engine developed on PHP MySQL. PHPMyWind version 5.6 is vulnerable to cross-site request forgery. An attacker can use this vulnerability to create a new administrator account without authentication...

Erc20.transferFrom() doesn't work on non-standard compliant tokens like USDT

Handle pants Vulnerability details Non-standard compliant tokens like USDT don't return a return value on transferFrom. The function Erc20.transferFrom reverts if the token doesn't return a return value, as it is defined to always return a boolean. Impact When using any non-standard compliant tok...

Erc20.approve() doesn't work on non-standard compliant tokens like USDT

Handle pants Vulnerability details Non-standard compliant tokens like USDT don't return a return value on approve. The function Erc20.approve reverts if the token doesn't return a return value, as it is defined to always return a boolean. Impact When using any non-standard compliant token like...

Erc20.transfer() doesn't work on non-standard compliant tokens like USDT

Handle pants Vulnerability details Non-standard compliant tokens like USDT don't return a return value on transfer. The function Erc20.transfer reverts if the token doesn't return a return value, as it is defined to always return a boolean. Impact When using any non-standard compliant token like...

What are Open Source Software License Risks?

Explore the risks of using open source licenses and what tools to use to mitigate risks for safer, more legally compliant applications...

ECOA Building Automation System Cross Site Request Forgery Vulnerability

ECOA building automation systems suffer from a cross site request forgery vulnerability. Many versions are affected. ECOA Building Automation System Cross-Site Request Forgery Vendor: ECOA Technologies Corp. Product web page: http://www.ecoa.com.tw Affected version: ECOA ECS Router Controller - E...

ECOA Building Automation System Path Traversal / Arbitrary File Upload

ECOA Building Automation System Path Traversal Arbitrary File Upload Vendor: ECOA Technologies Corp. Product web page: http://www.ecoa.com.tw Affected version: ECOA ECS Router Controller - ECS FLASH ECOA RiskBuster Terminator - E6L45 ECOA RiskBuster System - RB 3.0.0 ECOA RiskBuster System - TRAN...

TokenHandler.safeTransferIn does not work on non-standard compliant tokens like USDT

Handle cmichel Vulnerability details Vulnerability Details The TokenHandler.safeTransferIn function uses the standard IERC20 function for the transfer call and proceeds with a checkReturnCode function to handle non-standard compliant tokens that don't return a return value. However, this does not...

CompoundToNotionalV2.enableToken ERC20 missing return value check

Handle cmichel Vulnerability details Vulnerability Details The enableToken function performs an ERC20.approve call but does not check the success return value. Some tokens do not revert if the approval failed but return false instead. Impact Tokens that don't actually perform the approve and retu...

TokenHandler.safeTransferOut does not work on non-standard compliant tokens like USDT

Handle cmichel Vulnerability details Vulnerability Details The TokenHandler.safeTransferOut function uses the standard IERC20 function for the transfer call and proceeds with a checkReturnCode function to handle non-standard compliant tokens that don't return a return value. However, this does no...

RLSA-2021:3079 Low: 389-ds:1.4 security and bug fix update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succee...

Design/Logic Flaw

A vulnerability in the change password API of Cisco Connected Mobile Experiences CMX could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements that are configured on an affected device. This vulnerability...

CVE-2021-1522

A vulnerability in the change password API of Cisco Connected Mobile Experiences CMX could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements that are configured on an affected device. This vulnerability...

Cisco Connected Mobile Experiences 信任管理问题漏洞

Cisco Connected Mobile Experiences is a Connected Mobile Experience from Cisco USA. A trust management issue vulnerability exists in Cisco Connected Mobile Experiences CMX that stems from an issue with the software change password interface. When using this interface to change passwords on the...

php: SSRF bypass in FILTER_VALIDATE_URL

A flaw was found in php. Currently, php's FILTERVALIDATEURL check doesn't recognize some non-compliant RFC 3986 URLs and returns them as valid. This flaw allows an attacker to craft URLs, which depending on how the URL filter checking is used on the application side, lead to Server Side Request...

Xuperchain has an unspecified vulnerability

Xuperchain is an application. It provides a blockchain infrastructure to build compliant blockchain network functions. version 3.6.0 of Xuperchain contains a security vulnerability that could be exploited by an attacker to obtain partial signatures in order to recover the private key of an...

Moderate: Red Hat Security Advisory: 389-ds:1.4 security and bug fix update

An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RLSA-2021:2595 Moderate: 389-ds:1.4 security and bug fix update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: syncrepl NULL pointer dereference in synccreatestatecontrol...