SUSE CVE-2012-4535

Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial of service Xen infinite loop and physical CPU consumption by setting a VCPU with an "inappropriate deadline."...

SUSE CVE-2015-5352

The x11openhelper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time...

Attacker can delay proposal rejection

Lines of code Vulnerability details Impact In OptimisticListingSeaport.rejectProposal, it revert if proposedListing.collateral if proposedListing.collateral proposedListing.collateral -= amount; Proof of Concept 1. Attacker propose at 10000 collateral at a very low price 2. Bob try to reject it b...

pref.pl Cross Site Scripting vulnerability OBB-3096288

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Permit should not approve type(uint256).max

Lines of code Vulnerability details Impact The design of permits should not be allowed to approve typeuint256.max. If not, depositAndTrade can be called many times until the allowance value becomes 0. Proof of Concept We should only allow baseTokenAmount only for baseToken and...

NFTs mintable after Auction deadline expires

Lines of code Vulnerability details Impact The buy function on the LPDA.sol contract is not validating if the auction is still running, allowing a purchase to be made after the stipulated time. The endtime variable used to store the end date of the auction is not used at any point to validate...

kernel: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC

A vulnerability was found in the Linux kernel's KVM component related to the LAPIC during the guest reboot process. This issue arises when the SETLAPIC command is issued without exposing the tsc-deadline mode, leading to warnings and potential inconsistencies due to an unhandled preemption timer...

kernel: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC

A vulnerability was found in the Linux kernel's KVM component related to the LAPIC during the guest reboot process. This issue arises when the SETLAPIC command is issued without exposing the tsc-deadline mode, leading to warnings and potential inconsistencies due to an unhandled preemption timer...

BlueHat 2023 Call for Papers is Now Open!

For nearly 20 years, BlueHat has been where the security research community, and Microsoft security professionals come together as peers, to share, debate, challenge, learn, and exchange ideas in the interest of creating a safer and more secure world for all. We are extremely excited to announce...

stirlingboaroundtable.co.uk Cross Site Scripting vulnerability OBB-2802702

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

getsomedosh.com Cross Site Scripting vulnerability OBB-2740604

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

lynx.com.gt Cross Site Scripting vulnerability OBB-2716006

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Unused deadline checker modifier may result in user fund loss due to unexpect transaction ordering (MEV)

Lines of code Vulne...

QA Report

ensure modifier - require statement is commented out The ensureuint deadline modifier is used in multiple functions such as addLiquidity and removeLiquidity but the require statement is commented out, the modifier is essentially usesless. modifier ensureuint deadline //requiredeadline =...

Stableswap - Deadline do not work

Lines of code Vulnerability details Impact The ensure modifier is commented, so deadlines will not work when passing orders, breaking this functionnality. --- The text was updated successfully, but these errors were encountered: All reactions...

This Week in Spring - June 28th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Im writing this from the Big Apple, New York City! Im here for the SpringOne Tour 2022 NYC event. This is my first time back in New York City since before the pandemic and it has been so much fun. Ive been catching up with...

_getTwav is not correct. It is not considering all last 4 blocks.

Lines of code Vulnerability details Impact This will result in invalid deadline to decide the buyout end. Proof of Concept /// @notice returns the TWAV of the last 4 blocks /// @return twav TWAV of the last 4 blocks function getTwav internal view returnsuint256 twav if...

Wrong Deadline

Lines of code Vulnerability details the deadline is the timestamp after which the transaction will revert. the goal of this field is that the caller can set a deadline for the transaction so the transaction will not succeed in any arbitrary time in the future, and after this deadline, they can...

Wrong Deadline

Lines of code Vulnerability details the deadline is the timestamp after which the transaction will revert. the goal of this field is that the caller can set a deadline for the transaction so the transaction will not succeed in any arbitrary time in the future, and after this deadline, they can...

Threat Source newsletter (May 12, 2022) — Mandatory MFA adoption is great, but is it too late?

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. Mandatory multi-factor authentication is all the rage nowadays. GitHub just announced that all contributors would have to enroll in MFA by 2023 to log into their accounts. And Google announced as part of... This is on...