CVE-2022-25647

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace method in internal classes, which may lead to DoS attacks...

CVE-2022-25647

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace method in internal classes, which may lead to DoS attacks...

CVE-2022-25647 Deserialization of Untrusted Data

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace method in internal classes, which may lead to DoS attacks...

Owner of the PoolAddressesProviderRegistry Contract Can Update the Pool Address and Effectively Lock Deposited Funds by Preventing All Withdrawals

Lines of code Vulnerability details Impact The owner of the PoolAddressesProviderRegistry contract is able to register and unregister providers as they see fit. Because AaveV3YieldSource.sol dynamically queries the Aave pool through this contract, it is possible for the owner of this Aave contrac...

User fund lose and DOS attack when totalSupply() is zero

Lines of code Vulnerability details Impact Hacker can do this two action: Perform a DOS attack and continuously deny users from supplying their tokens to YeildSource deposits less than a high amount will be rejected and attacker can control this amount, for example set it to 10K and every deposit...

Early Depositor can DOS Deposits

Lines of code Vulnerability details Impact A malicious, but generous, early depositor can DOS all future deposits. This is accomplished by directly sending aTokens to the AaveV3YieldSource.sol contract after making their first deposit. The amount of aTokens sent to the contract will manipulate th...

CVE-2022-22275

Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting in Denial of Service DoS attack if a target host is vulnerable...

Input validation

Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting in Denial of Service DoS attack if a target host is vulnerable...

Dep Group Remote Memory Exhaustion (Denial of Service) in ckb

Impact A remote attacker could exploit this vulnerability to exhaust ckb process memory of an affected node. Patches Upgrade to 0.43.1 or later. References After resolving the outpoints of one dep group, we put the corresponding content into a vec...

GHSA-J35P-Q24R-5367 Dep Group Remote Memory Exhaustion (Denial of Service) in ckb

Impact A remote attacker could exploit this vulnerability to exhaust ckb process memory of an affected node. Patches Upgrade to 0.43.1 or later. References After resolving the outpoints of one dep group, we put the corresponding content into a vec...

CVE-2022-22969

Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the...

CVE-2022-22969

Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the...

CVE-2022-21465

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

CVE-2022-21425

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

SUSE-SU-2022:1267-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP4 kernel was updated. The following security bugs were fixed: - CVE-2022-0812: Fixed an incorrect header size calculations which could lead to a memory leak. bsc1196639 - CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to ...

SUSE-SU-2022:1266-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated. The following security bugs were fixed: - CVE-2022-28356: Fixed a refcount bug in llcuibind and llcuiautobind which could allow an unprivileged user to execute a DoS. bnc1197391 - CVE-2022-1016: Fixed a vulnerability in the nftables component o...

CVE-2022-24863

A flaw was found in http-swagger. This flaw allows an attacker to perform a denial of service attack consisting of memory exhaustion on the host system due to improper handling of HTTP methods...

CVE-2022-28041

stbimage.h v2.27 was discovered to contain an integer overflow via the function stbijpegdecodeblockprogdc. This vulnerability allows attackers to cause a Denial of Service DoS via unspecified vectors...

CVE-2022-1337 OOM DoS in Mattermost image proxy

The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files...

CVE-2022-22188

An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine PFE of Juniper Networks Junos OS allows a network-based unauthenticated attacker to flood the device with traffic leading to a Denial of Service DoS. The device must be configur...