Upgraded Q -> M from 868 [1666360678566]

Judge has assessed an item in Issue 868 as Medium risk. The relevant finding follows: Using .call instead of .transfer Currently it is using .transfer to transfer ETH payablepayAddress.transferpayAmt; Using deprecated transfer on address payable may revert in these cases: 1. The withdraw recipien...

GHSA-7QW2-H9GJ-HCVH Sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin

Pipeline: Groovy Libraries Plugin and older releases of the Pipeline: Deprecated Groovy Libraries Plugin formerly Pipeline: Shared Groovy Libraries Plugin define the library Pipeline step, which allows Pipeline authors to dynamically load Pipeline libraries. The return value of this step can be...

CVE-2022-43406

A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute...

Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin and Pipeline: Deprecated Groovy Libraries Plugin

Pipeline: Groovy Libraries Plugin and older releases of the Pipeline: Deprecated Groovy Libraries Plugin formerly Pipeline: Shared Groovy Libraries Plugin define the library Pipeline step, which allows Pipeline authors to dynamically load Pipeline libraries. The return value of this step can be...

CVE-2022-43406

CVE-2022-43406 is a sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier. The issue allows attackers with permission to define untrusted Pipeline libraries to define and run sandboxed scripts, including Pipelines, enabling arbitrary c...

Jenkins Plugin Pipeline: Deprecated Groovy Libraries security vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2022-43406: Undefined Security Weakness

A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute...

CVE-2022-43406

A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute...

OTRS Multiple Vulnerabilities (OSA-2022-06, OSA-2022-05)

OTRS is prone to multiple vulnerabilities. This VT has been deprecated as a duplicate of the VT SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

UBUNTU-CVE-2022-20422

In emulationprochandler of armv8deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

CVE-2022-20422

In emulationprochandler of armv8deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

Using a Custom Cipher with `NID_undef` may lead to NULL encryption

OpenSSL supports creating a custom cipher via the legacy EVPCIPHERmethnew function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0...

CVE-2022-20422

In emulationprochandler of armv8deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

Crate `parity-wasm` deprecated by the author

This PR explicitly deprecates parity-wasm. The author recommends switching to wasm-tools...

RUSTSEC-2022-0061 Crate `parity-wasm` deprecated by the author

This PR explicitly deprecates parity-wasm. The author recommends switching to wasm-tools...

PT-2022-37427 · Unknown · Parity-Wasm

Name of the Vulnerable Software and Affected Versions: parity-wasm affected versions not specified Description: The parity-wasm software has been explicitly deprecated. The author recommends switching to wasm-tools. Recommendations: At the moment, there is no information about a newer version tha...

OPENSUSE-SU-2022:10132-1 Security update for lighttpd

This update for lighttpd fixes the following issues: lighttpd was updated to 1.4.66: a number of bug fixes Fix HTTP/2 downloads = 4GiB Fix SIGUSR1 graceful restart with TLS futher bug fixes CVE-2022-37797: null pointer dereference in modwstunnel, possibly a remotely triggerable crash boo1203358 I...

Upgraded Q -> M from 238 [1663858577471]

Judge has assessed an item in Issue 238 as Medium risk. The relevant finding follows: 2. call should be used instead of transfer on an address payable Sometimes this kind of issue is considered as Medium risk. The use of the deprecated transfer function for an address will inevitably make the...

CVE-2022-39956

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and...

Use safeTransferFrom() function instead of transferFrom()

Lines of code Vulnerability details Impact The transferFrom method is used in the contract PartyGovernanceNFT.sol, I however argue that this isn’t recommended because: OpenZeppelin’s documentation discourages the use of transferFrom, use safeTransferFrom whenever possible Given that any NFT can b...