CVE-2022-30245

Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller configuration without the...

CVE-2022-30242

Honeywell Alerton Ascent Control Module ACM through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller...

CVE-2022-30242

Honeywell Alerton Ascent Control Module ACM through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller...

CVE-2022-30242

Honeywell Alerton Ascent Control Module ACM through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller...

Design/Logic Flaw

Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller configuration without the...

Design/Logic Flaw

Honeywell Alerton Ascent Control Module ACM through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller...

CVE-2022-30242

Honeywell Alerton Ascent Control Module ACM through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller...

Inconsistent state of _terminalsOf & _primaryTerminalOf state variables at JBDirectory

Lines of code Vulnerability details Vulnerability details When a call to setTerminalsOf is followed by setPrimaryTerminalOf, the state variables, terminalsOf & primaryTerminalOf, are maintained in consistent state by including the primaryTerminal in terminals also. Refer, But when a call to...

Inconsistency in view functions can lead to users believing they’re due for more BKD rewards

Lines of code Vulnerability details Impact The view functions used for a user to check their claimable rewards vary in their implementation. This can cause users to believe they are due X amount but will receive Y. Proof of Concept If the inflationRecipient is set, then poolStakedIntegral will be...

AZL-9891 CVE-2022-30115 affecting package curl for versions less than 7.83.1-1

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or th...

CVE-2021-38445

OCI OpenDDS versions prior to 3.18.1 do not handle a length parameter consistent with the actual length of the associated data, which may allow an attacker to remotely execute arbitrary code...

CVE-2021-38445 OCI OpenDDS Secure Improper Handling of Length Parameter Inconsistency

OCI OpenDDS versions prior to 3.18.1 do not handle a length parameter consistent with the actual length of the associated data, which may allow an attacker to remotely execute arbitrary code...

CVE-2022-0677

Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools in relay role, GravityZone in Update Server role allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to...

CVE-2022-0677 Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)

Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools in relay role, GravityZone in Update Server role allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to...

UserLock information can be found during emergency mode

Lines of code Vulnerability details When the contract is in blocked state emergency mode, the protocol wants to return an empty UserLock info, on calling the function getUserLock. However, there is another way, by which the users can find the same information. The below function is not protected...

_withdrawLiquidity() is Not Consistent With start()

Lines of code Vulnerability details Impact withdrawLiquidity details a number of scenarios under which a user may withdraw their liquidity. The first two scenarios outline cases where the credit line has either been cancelled by the borrower or insufficient assets have been lent out to the pool b...

QA Report

LOW : 1. Title : permitAndMulticall can be frontrun, that will lead to the user must reasign the TX Impact : In the permitAndMulticall it takes from as a user input, since all tx in the blockchain is public, a malicious user might frontrun the permitAndMulticall and providing 0 data, which will...

Twitter: Delete direct message history without access the proper conversation_id

Hello Team i found a bug in your system this bug already fixed as i know,but i try this another way, and its worked, this is why i report it the bug is i was able to delete message history without access the proper conversation id user 1 id: 1234 user 2 id: 5678 their conversation look like...

NestedFactory does not track operators properly

Lines of code Vulnerability details NestedFactory extends the MixinOperatorResolver contract which comes from the synthetix/MixinResolver.sol code base where the expectation is that isResolverCached returns false until rebuildCache is called and the cache is fully up to date. Due to a medium issu...

SAILFISH System to Find State-Inconsistency Bugs in Smart Contracts

A group of academics from the University of California, Santa Barbara, has demonstrated what it calls a "scalable technique" to vet smart contracts and mitigate state-inconsistency bugs, discovering 47 zero-day vulnerabilities on the Ethereum blockchain in the process. Smart contracts are program...