Heap overflow

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, heap can be overflowed by providing a PIDPROPERTYLIST parameter that contains a CDR string with length larger than the size of...

CVE-2023-39949 Improper validation of sequence numbers leading to remotely reachable assertion failure

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.9.1 and 2.6.5, improper validation of sequence numbers may lead to remotely reachable assertion failure. This can remotely crash any Fast-DDS process. Versions...

CVE-2023-39946

Summary: CVE-2023-39946 affects eProsima Fast DDS. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, a heap overflow can be triggered by a PID_PROPERTY_LIST containing a crafted CDR string. In ParameterPropertyList_t::push_back_helper, the second memcpy can copy user-controlled data from the CD...

CVE-2023-39946

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, heap can be overflowed by providing a PIDPROPERTYLIST parameter that contains a CDR string with length larger than the size of...

GaugeController` allows for quick vote and withdraw

Lines of code Vulnerability details This issue was identified in the original Curve Finance audit, finding ID TOB-CURVE-DAO-004. It remains unresolved in the mkt.market implementation, but was fixed in the Curve implementation. Impact A malicious voter is able to use full voting power for multipl...

Contrary to sponsor's intent, the gauge's weight will not be updated properly if governance do not change weight before any voting

Lines of code Vulnerability details Impact This is the intended procedure based on Sponsor's answer in discord: Q: when we add new gauge we don't set any weight point or any data for it, did the new gauge will get the weight and power by time when users vote for it ?! A: Yes, the idea is that the...

GaugeController._get_sum() returns wrong value, breaking vote accounting

Lines of code Vulnerability details Impact The function to account for past historic total gauge weights getsum is supposed to return the sum for the future week. Instead it returns the sum for the oldest updated week. The returned value is used in voteforgaugeweights to compute the sum after the...

openSUSE 15 Security Update : chromium (openSUSE-SU-2023:0216-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0216-1 advisory. - Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page...

HTTP Request Smuggling

protocol-http1 is vulnerable to HTTP Request Smuggling. The vulnerability exists in the read function of chunked.rb due to improper HTTP/1 implementation based on the RFC spec, such as allowing Content-Length header values with a + or 0x prefix, which can lead to HTTP request smuggling and firewa...

Authorization Bypass

chromium is vulnerable to Authorization Bypass. The vulnerability exists due to the inappropriate implementation in the prompts in the library, which allows an attacker to bypass permission restrictions via a crafted HTML page...

_computeAvailable() the calculations are wrong

Lines of code Vulnerability details Impact computeAvailable incorrect calculations that result in a return value greater than the current balance, causing methods such as liquidate to fail Proof of Concept VaultBooster.computeAvailable used to count the number of tokens currently available There...

Microsoft Edge (Chromium) < 114.0.1823.106 / 115.0.1901.200 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 114.0.1823.106 / 115.0.1901.200. It is, therefore, affected by multiple vulnerabilities as referenced in the August 7, 2023 advisory. - Microsoft Edge Chromium-based Security Feature Bypass Vulnerability CVE-2023-38157...

VaultBoosterFactory allows deployment of VaultBooster with phoney PrizePool

Lines of code Vulnerability details Impact A malicious VaultBooster can be deployed via VaultBoosterFactory contract. Users may lose funds while interacting with such VaultBooster. File: src/VaultBoosterFactory.sol function createVaultBoosterPrizePool prizePool, address vault, address owner...

CVE-2022-4955

CVE-2022-4955 concerns Google Chrome before 108.0.5359.71, where an improper DevTools implementation could allow a user who installs a crafted extension via a malicious HTML page to bypass file access restrictions. The vulnerability stems from DevTools behavior and enables an attacker to exploit ...

Incorrect implementation of solvent() modifier

Lines of code Vulnerability details Impact In Market.sol, solvent modifier is given as below, modifier solventaddress from updateExchangeRate; accrue; ; requireisSolventfrom, exchangeRate, "Market: insolvent"; Here the modifier has used the accrue directly, however while the functions being used ...

FreeBSD : chromium -- multiple vulnerabilities (6e4e8e87-9fb8-4e32-9f8e-9b4303f4bfd5)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6e4e8e87-9fb8-4e32-9f8e-9b4303f4bfd5 advisory. - Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to...

CVE-2023-4078

Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

Design/Logic Flaw

Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-26451

Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts...

Authorization

Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts...