965 matches found
Wrong calculation for the new rewardRate[token] can cause some of the late users can not get their rewards
Lines of code Vulnerability details uint bribeStart = block.timestamp - block.timestamp % 7 days + BRIBELAG; uint adjustedTstamp = block.timestamp = periodFinishtoken safeTransferFromtoken, msg.sender, addressthis, amount; rewardRatetoken = amount / DURATION; else uint remaining = periodFinishtok...
Magento observable timing discrepancy vulnerability
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...
GHSA-XGP9-J48H-JJF9 Magento observable timing discrepancy vulnerability
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...
Magento Signature verification bypass
Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...
Improperly Skewed Governance Mechanism
Lines of code Vulnerability details ALR-02H: Improperly Skewed Governance Mechanism | File | Lines | Type ---|---|--- AuraLocker.sol | L594-L609, L611-L618 | Governance Susceptibility Description The balance checkpointing system exposed by the contract for governance purposes is flawed as it does...
CVE-2020-14002
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts where no host key for the server has been cached by the client...
GHSA-FWHR-G5R4-XGXF Silverstripe CMS User Enumeration
Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks...
L10: Deposits don’t work with FoT tokens
78 comment Warden: hickuphh3 Line References Description FoT token deposits are not supported because amount is used for internal accounting, but the actual amount received will be less than it due to the fee. I gave a low severity rating because of the existence of a token whitelist. Referenced...
CVE-2021-33149
CVE-2021-33149 pertains to an observable behavioral discrepancy in some Intel processors that may allow an authorized user to disclose information via local access. The Intel advisory (INTEL-SA-00648) confirms affected products as all Intel processor families and assigns a CVSSv3.1 base score of ...
NewStart CGSL CORE 5.05 / MAIN 5.05 : microcode_ctl Multiple Vulnerabilities (NS-SA-2022-0046)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has microcodectl packages installed that are affected by multiple vulnerabilities: - Incomplete cleanup from specific special register read operations in some IntelR Processors may allow an authenticated user to potentially...
Wrong amount will be passed with fee on transfer tokens
Lines of code Vulnerability details Impact Loss of 1 to 1 ratio with fee on transfer tokens Proof of Concept Some tokens like USDT have a fee on transfer that can be activated. If such a token is used then wrong amounts will be minted on the other side. As we can see in the sendToCosmos function ...
NewStart CGSL MAIN 6.02 : microcode_ctl Multiple Vulnerabilities (NS-SA-2022-0060)
The remote NewStart CGSL host, running version MAIN 6.02, has microcodectl packages installed that are affected by multiple vulnerabilities: - Incomplete cleanup from specific special register read operations in some IntelR Processors may allow an authenticated user to potentially enable...
Hitachi Energy System Data Manager
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: System Data Manager – SDM600 Vulnerabilities: Integer Overflow or Wraparound, Reachable Assertion, Type Confusion, Uncontrolled Recursion, Observable Discrepancy 2. RISK...
Hitachi Energy MicroSCADA Pro/X SYS600
1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: MicroSCADA Pro/X SYS600 Vulnerabilities: Observable Discrepancy, HTTP Request Smuggling, Classic Buffer Overflow, Improper Certificate Validation, Improper Restriction of...
Design/Logic Flaw
IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attempts. IBM X-Force ID: 220487...
CVE-2022-22356
IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attempts. IBM X-Force ID: 220487...
IBM MQ Appliance 安全漏洞
IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM U.S.A. An information disclosure vulnerability exists in IBM MQ Appliance, which stems from an apparent discrepancy between valid and invalid login attempts, and can be exploited by...
Code injection
In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state...
