HybridPool._updateReserves Wrong implementation

Handle WatchPug Vulnerability details HybridPool.updateReserves is supposed to update the reserves to the latest bento share amounts. Instead, it uses underlying token amounts. In the getReserves function, reserves are treated as bento share amounts and get converted to underlying token amounts...

Wrong implementation of _sqrt function

Handle pants Vulnerability details Use a library for that. Don't implement yourself. line 187. --- The text was updated successfully, but these errors were encountered: All reactions...

ZOHO ManageEngine ADManager Plus 代码问题漏洞

ZOHO ManageEngine ADManager Plus is a Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and help desk technicians with day-to-day administrative tasks, such as bulk management of user accounts and A...

in kcal-app/kcal

Description Weak password implementation Proof of Concept step 1: login into account goto http://demo.kcal.cooking/users/kcal/edit step 2: change password kcal to 12 and save changes step 3: we can see updated message application is allowing to set weak password. poc of image in below link...

Chromium: CVE-2021-37966 Inappropriate implementation in Compositing

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2021-37958 Inappropriate implementation in Navigation

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Samba 2.0.0 <= 3.0.9 Vulnerability (CVE-2004-1154)

Integer overflow could lead to remote code execution RCE. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:samba:samba";...

Microsoft Edge (Chromium) < 94.0.992.31 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 94.0.992.31. It is, therefore, affected by multiple vulnerabilities as referenced in the September 24, 2021 advisory. - Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had...

GHSA-65P7-PJJ8-GGMR Member account takeover

Impact An error in the implementation of the member email change functionality allows unauthenticated users to change the email address of arbitrary member accounts to one they control by crafting a request to the relevant API endpoint, and validating the new address via magic link sent to the ne...

RUSTSEC-2021-0114 Aliased mutable references from `tls_rand` & `TlsWyRand`

TlsWyRand's implementation of Deref unconditionally dereferences a raw pointer, and returns multiple mutable references to the same object, which is undefined behavior...

openSUSE 15 Security Update : chromium (openSUSE-SU-2021:1303-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1303-1 advisory. - Chromium: CVE-2021-30606 Use after free in Blink CVE-2021-30606 - Chromium: CVE-2021-30607 Use after free in Permissions CVE-2021-30607 -...

Improperly Implemented path matching for in-toto-golang

Impact Authenticated attackers posing as functionaries i.e., within a trusted set of users for a layout are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact ...

The Gap in Your Zero Trust Implementation

Over the last several years, there have been numerous high-profile security breaches. These breaches have underscored the fact that traditional cyber defenses have become woefully inadequate and that stronger defenses are needed. As such, many organizations have transitioned toward a zero trust...

openSUSE 15 Security Update : chromium (openSUSE-SU-2021:1300-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1300-1 advisory. - Chromium: CVE-2021-30606 Use after free in Blink CVE-2021-30606 - Chromium: CVE-2021-30607 Use after free in Permissions CVE-2021-30607 -...

CVE-2021-41087 Improperly Implemented path matching for in-toto-golang

in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries i.e., within a trusted set of users for a layout are able to create attestations that may bypass DISALLOW rules in the sa...

chromium -- multiple vulnerabilities

Chrome Releases reports: This update contains 19 security fixes, including: 1243117 High CVE-2021-37956: Use after free in Offline use. Reported by Huyna at Viettel Cyber Security on 2021-08-24 1242269 High CVE-2021-37957: Use after free in WebGPU. Reported by Looben Yang on 2021-08-23 1223290 Hi...

http4s 注入漏洞

http4s is an open source streaming HTTP server for Scala. http4s suffers from an injection vulnerability that arises from improper design or implementation during code development of a network system or product...

libde265 Heap Buffer Overflow Vulnerability (CNVD-2021-79731)

libde265 is an open source implementation of the h.265 video codec. libde265 version 1.0.4 contains a heap buffer overflow vulnerability in the mmloadlepi64 function. An attacker can exploit this vulnerability via specially crafted files to cause a denial of service...

UUPSUpgradeable vulnerability in @openzeppelin/contracts

Impact Upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon. Patches A fix is included in version 4.3.2 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeabl...

UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable

Impact Upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon. Patches A fix is included in version 4.3.2 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeabl...