11756 matches found
Upgraded Q -> M from 94 [1653831846680]
Judge has assessed an item in Issue 94 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
BathToken with initial liquidity of 1 wei causes very expensive share price leading to precision errors and loss of funds
Lines of code Vulnerability details Impact The creator of a new BathToken is able to maliciously manipulate the share price by providing lowest possible amount 1 wei of liquidity initialLiquidityNew and then artificially blowing up the BathToken token balance. Following depositors will loose thei...
Security update for libredwg (moderate)
SUSE Security Update: Security update for libredwg Announcement ID: openSUSE-SU-2022:0149-1 Rating: moderate References: 1193372 1194767 Cross-References: CVE-2021-28237 CVE-2022-21658 CVSS scores: CVE-2022-21658 NVD : 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2022-21658 SUSE: 6.2...
The vulnerability of the Storage Spaces Direct distributed storage function in the Microsoft Windows operating system allows a hacker to exploit their privileges.
The vulnerability of the Storage Spaces Direct distributed storage function in the Microsoft Windows operating system is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability can allow an attacker to gain increased privileges...
The vulnerability of the Windows operating system’s kernel allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Windows operating system’s kernel is related to errors in information processing. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information...
The vulnerability of the Windows iSCSI Target service allows a hacker to gain unauthorized access to protected information.
The vulnerability of the Windows iSCSI Target service for Windows operating systems is related to errors in information processing. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
The vulnerability of Windows Hyper-V’s hardware virtualization technology allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Windows Hyper-V hardware virtualization system in Windows operating systems is related to errors in information processing. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information remotely...
Business Logic Errors in Para
Paraara prior to version 1.46.0 is vulnerable to business logic errors. A user can create more than one app, even after they reach the app limit...
GHSA-4793-8WWH-JXXR Business Logic Errors in Para
Paraara prior to version 1.46.0 is vulnerable to business logic errors. A user can create more than one app, even after they reach the app limit...
AttesterSlashing number overflow
Impact Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Since we represent uint64 values as native javascript numbers, there is an issue when those variables with large greater than 2^53 uint64 values are included on chain. In those...
GHSA-CVJ7-5F3C-9VG9 AttesterSlashing number overflow
Impact Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Since we represent uint64 values as native javascript numbers, there is an issue when those variables with large greater than 2^53 uint64 values are included on chain. In those...
GHSA-XV69-6RF3-W5G2 Missing permission check in Jenkins Cloud Statistics Plugin
Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages. Jenkins Cloud Statistics Plugin 0.27 requires...
Missing Initialization of Resource in Apache Arrow
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...
CVE-2022-29219
Lodestar is a TypeScript implementation of the Ethereum Consensus specification. Prior to version 0.36.0, there is a possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Because the developers represent uint64 values as native javascript...
Code injection
Lodestar is a TypeScript implementation of the Ethereum Consensus specification. Prior to version 0.36.0, there is a possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Because the developers represent uint64 values as native javascript...
CVE-2022-29219 Integer Overflow in Lodestar
Lodestar is a TypeScript implementation of the Ethereum Consensus specification. Prior to version 0.36.0, there is a possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Because the developers represent uint64 values as native javascript...
CVE-2022-29219
Lodestar (TypeScript Ethereum Consensus) before v0.36.0 is vulnerable due to using native JavaScript numbers for uint64 values in AttesterSlashing/ProposerSlashing, causing rounding errors for large values (>2^53). This can yield consensus splits or valid Slashing being treated as invalid, pot...
CVE-2022-1848
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
