AssetManager's rebalance function can fail if the last moneyMarket doesn't support a token and the balance gathered is odd

Handle hyh Vulnerability details Summary AssetManager's rebalance function, , will fail if the last moneyMarket doesn't support a token its supportsTokentokenAddress is false, while remaining balance be positive, which can be the case even if no allocation to the last moneyMarket is due as a dust...

depositAndFix can be made to fail

Handle cmichel Vulnerability details There's a griefing attack where an attacker can make any user transaction for TempusController.depositAndFix fail. In depositAndFix, swapAmount many yield shares are swapped to principal where swapAmount is derived from the function arguments. A final...

PT-2021-8175

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a list corruption vulnerability in the Linux kernel's lpfc driver. When the driver attempts to pass requests to the adapter and fails, a local fail msg string is...

Rust Failure Crate Vulnerable to Type confusion

Safe Rust code can implement malfunctioning privategettypeid and cause type confusion when downcasting, which is an undefined behavior. Users who derive Fail trait are not affected...

GHSA-R98R-J25Q-RMPR Rust Failure Crate Vulnerable to Type confusion

Safe Rust code can implement malfunctioning privategettypeid and cause type confusion when downcasting, which is an undefined behavior. Users who derive Fail trait are not affected...

CVE-2021-37673

TensorFlow maps-stage DoS (CVE-2021-37673). The issue arises from tf.raw_ops.MapStage not validating non-empty key tensors, enabling a local attacker to trigger a denial-of-service via a CHECK-fail. Patches were committed and the fix is expected in TensorFlow 2.6.0, with backports to 2.5.1, 2.4.3...

CVE-2021-37654 Heap OOB and CHECK fail in `ResourceGather` in TensorFlow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a CHECK-fail in debug builds of TensorFlow using tf.rawops.ResourceGather or a read from outside the bounds of heap allocated data in the same API in a release build. Th...

PT-2021-21770 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: An attacker can trigger a crash via a CHECK-fail in debug builds of TensorFlow...

CVE-2021-37673: Improper Input Validation

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a denial of service via a CHECK-fail in tf.rawops.MapStage. The implementation does not check that the key input is a valid non-empty tensor. We have patched the issue in GitHub...

mdadm bug fix and enhancement update

The mdadm packages contain a utility for creating, managing, and monitoring Linux multiple disk MD devices. Bug Fixes and Enhancements: FJ8.2 Bug: RAID volume status is not updated when multiple drives fail. BZ1965414...

CVE-2021-36213

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...

Design/Logic Flaw

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...

UBUNTU-CVE-2021-36213

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...

CVE-2021-36213

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...

CVE-2021-36213: Undefined Security Weakness

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...

Consul’s Application-Aware Intentions Deny Action Fails Open When Combined With Default Deny Policy

Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that using defaultpolicy = "deny" with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. This vulnerability, CVE-2021-36213,...

GSD-2021-1000903 KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message

KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.126 by commit...

CVE-2020-25754

An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an...

Arkhota - A Web Brute Forcer For Android

What? Arkhota is a web HTTP/S brute forcer for Android. Why? A web brute forcer is always in a hacker's computer, for obvious reasons. Sometimes attacks require to be quick or/and with minimal device preparation. Also a phone takes less attention rather than a laptop/computer. For this situations...

Violation of implicit constraints in batched operations may break protocol assumptions

Handle 0xRajeev Vulnerability details Impact The Ladle batching of operations is a complex task as noted by the project lead which has implicit constraints on what operations can be bundled together in a batch, which operations can/have-to appear how many times and in what order/sequence etc. Som...