deadline using swap functions does not verify that the deadline has passed/expired

Lines of code Vulnerability details Impact In V3Proxy.sol contract, deadline is used in functions like swapExactTokensForTokens, swapTokensForExactTokens, swapExactETHForTokens, swapETHForExactTokens, swapTokensForExactETH and swapExactTokensForETH etc to ensure that the transaction can be execut...

INCORRECT ACCESS CONTROL

Lines of code Vulnerability details Impact Access control plays an important role in segregation of privileges in smart contracts and other applications. If this is misconfigured or not properly validated on sensitive functions, it may lead to loss of funds, tokens and in some cases compromise of...

PT-2023-35935 · Git +1 · Clamav

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free READ 1 crash type. The crash state involves functions such as yr parser lookup loop variable, yara yyparse,...

PT-2023-5956 · Php +11 · Php +11

Name of the Vulnerable Software and Affected Versions: PHP versions 8.0. through 8.0.29 PHP versions 8.1. through 8.1.21 PHP versions 8.2. through 8.2.7 Description: The issue is related to the way PHP's XML functions rely on libxml global state to track configuration variables. This state can be...

CVE-2018-11694

...

DEBIAN-CVE-2023-3817

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

CVE-2023-3817 Excessive time spent checking DH q parameter value

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

Malicious code in stranger-strings-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0eb204bfcf29270cc49274f3388170c77d866c2f6e0a88d4336c01732a365768 The OpenSSF Package Analysis project identified 'stranger-strings-functions' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

The onlyProfileOwnerOrDelegatedExecutor and whenNotPaused checks can be bypassed

Lines of code Vulnerability details Impact The LensHub.sol functions setProfileMetadataURI, setProfileMetadataURIWithSig, setFollowModule, setFollowModuleWithSig, collect, collectWithSig, act, actWithSig, setProfileImageURI, setProfileImageURIWithSig and others use...

treasury approveSmallSpending, approveMediumSpend and approveLargeSpend and setThreshold and setGSCAllowance can be frontrunned

Lines of code Vulnerability details Line of code: Impact treasury approveSmallSpending, approveMediumSpend and approveLargeSpend can be frontrunned Proof of Concept the AracheTreasury, there are three spending relate function: approveSmallSpend, approveMediumSpend, approveLargeSpend both of these...

Malicious proposal can drain the treasury contract and bypass the gscAllowance[token] check

Lines of code Vulnerability details Impact Malicious proposal can drain the treasury contract and bypass the gscAllowancetoken check Proof of Concept See this two function: function gscSpend address token, uint256 amount, address destination external onlyRoleGSCCOREVOTINGROLE nonReentrant if...

PT-2023-26545 · Unknown · Paddlepaddle

Name of the Vulnerable Software and Affected Versions: PaddlePaddle versions prior to 2.5.0 Description: The issue is related to a flaw that can cause a runtime crash and a denial of service. It is associated with FPE in paddle.trace and paddle.linalg.matrix power in PaddlePaddle. Recommendations...

GameOver(lay) Privilege Escalation and Container Escape

This module exploits the use of unsafe functions in a number of Ubuntu kernels utilizing vulnerable versions of overlayfs. To mitigate CVE-2021-3493 the Linux kernel added a call to vfssetxattr during ovldosetxattr. Due to independent changes to the kernel by the Ubuntu development team...

CVE-2022-46901

An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is an Access Control Violation for Database Operations. The Vocera Report Console contains a websocket interface that allows for the unauthenticated execution of various tasks and database functions. This...

Design/Logic Flaw

An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is an Access Control Violation for Database Operations. The Vocera Report Console contains a websocket interface that allows for the unauthenticated execution of various tasks and database functions. This...

CVE-2023-35078

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication...

phpscriptpoint Lawyer 跨站脚本漏洞

Lawyer is a legal and attorney website by the phpscriptpoint team. A cross-site scripting vulnerability exists in phpscriptpoint Lawyer version 1.6, which stems from the presence of some unknown functions in page.php that lead to cross-site scripting...

CVE-2023-33777

An issue in /functions/fbaorder.php of Prestashop amazon before v5.2.24 allows attackers to execute a directory traversal attack...

CVE-2023-33777: Improper Limitation of a Pathname to a Restricted Directory

An issue in /functions/fbaorder.php of Prestashop amazon before v5.2.24 allows attackers to execute a directory traversal attack...

Lawyer 跨站脚本漏洞

Lawyer is a legal and lawyer website by the phpscriptpoint team. A cross-site scripting vulnerability exists in phpscriptpoint Lawyer version 1.6, which stems from the presence of some unknown functions in search.php that lead to cross-site scripting...