CVE-2022-37453

An issue was discovered in Softing OPC UA C++ SDK before 6.10. A buffer overflow or an excess allocation happens due to unchecked array and matrix bounds in structure data types...

CVE-2022-37453

CVE-2022-37453 affects Softing OPC UA C++ SDK prior to version 6.10. The issue is a buffer overflow or excessive allocation caused by unchecked bounds on arrays/matrices within structure data types. Impact is high (availability impact stated), with exploitation potential over the network in affec...

outboundTransfer should return excess msg.value

Lines of code Vulnerability details Impact In function outboundTransfer, if users sends more msg.value than required, by accident, then the remaining msg.value is not sent back. So, if msg.value amount argument, then the excess msg.value is not sent back to msg.sender. This causes loss of funds f...

User can send an excess of ETH to L1GraphTokenGateway

Lines of code Vulnerability details Impact User can send too much ether into the contract which may get stuck if there is issues with the refund process. Proof of Concept User sends too much ether to outboundTransfer. This is sent to a refund address in Arbitrum. If Arbitrum is compromised or suc...

Besu VM vulnerable to gas allocation error in CALL operations

Impact An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in th...

GHSA-4456-W38R-M53X Besu VM vulnerable to gas allocation error in CALL operations

Impact An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in th...

CVE-2022-31222

Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by consuming excess memory in order to cause the application to crash...

Design/Logic Flaw

Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by consuming excess memory in order to cause the application to crash...

The skim function allows to withdraw tokens for any address

Lines of code Vulnerability details Impact Any address can call the skim function and remove tokens that are in excess of the reserves of those tokens. This would lead to the loss of token 0 and 1. Recommended Mitigation Steps You should have an access control so that only the factory, for exampl...

RHEL 9 : .NET 6.0 (RHSA-2022:4588)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4588 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

User's may accidentally overpay in register() / renew() and the excess will be paid to the vault creator :-

Lines of code Vulnerability details Vulnerability details Impact User's may accidentally overpay in register / renew and the excess will be paid to the vault creator Proof of Concept 1. File: 2022-08-mimo/contracts/actions/MIMORebalance.sol line 129-132: require...

CVE-2022-31226

Dell BIOS versions contain a Stack-based Buffer Overflow vulnerability. A local authenticated malicious user could potentially exploit this vulnerability by sending excess data to a function in order to gain arbitrary code execution on the system...

CVE-2021-39016

IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the software to transmit more traffic than should be allowed for that actor. IBM X-Force ID: 213722...

OESA-2022-1744 curl security update

Security Fixes: A vulnerability was found in curl. This issue occurs because it mishandles message verification failures when curl does FTP transfers secured by krb5. This flaw makes it possible for a Man-in-the-middle attack to go unnoticed and allows data injection into the client.CVE-2022-3220...

Malicious Package

Overview web-excess is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Upgraded Q -> H from 285 [1655952312863]

Judge has assessed an item in Issue 285 as High risk. The relevant finding follows: 1. Excess ether sent to FixedPricePassThruGate is lost low passThruGate redirects to a beneficiary only gate.ethCost, requiring that msg.value = gate.ethCost. As there are no other ways to access native tokens hel...

CVE-2022-31589

Due to improper authorization check, business users who are using Israeli File from SHAAM program /ATL/VQ23 transaction, are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted...

CVE-2022-31589

Due to improper authorization check, business users who are using Israeli File from SHAAM program /ATL/VQ23 transaction, are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted...

Malicious code in web-excess (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 203e8614dafc1923f99d9a6344719fe855ea8060bbaa87f636fe07d0c6c06319 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7068 Malicious code in web-excess (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 203e8614dafc1923f99d9a6344719fe855ea8060bbaa87f636fe07d0c6c06319 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...