The LegendaryGobbler can has emissionMultiple == 0

Lines of code Vulnerability details Impact The user could mint LegendaryGobbler with emissionMultiple == 0 Proof of Concept On legendaryGobblerPrice In case this check executed if numMintedSinceStart = LEGENDARYAUCTIONINTERVAL return 0; The cost on mintLegendaryGobbler will be cost == 0 That mean...

Time rounding can cause users to not be able to withdraw all the funds they are eligible for

Lines of code Vulnerability details Impact The time that has passed from the start of the vest is rounded down to the closest multiplication of claim.releaseIntervalSecs. The user can claim the funds for an interval only at the end of it. That means that users can't withdraw the funds for a part ...

PT-2022-32795

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.134 Description A data-race issue exists around sysctl tcp probe interval. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.10.134,...

PT-2022-33041

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.254 Description The issue is related to a data-race around sysctl tcp probe interval. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2022-32610

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.58 Description A data-race issue exists around sysctl tcp probe interval. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v4.1 and is fixed in Linux...

PT-2022-32388

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.15 Description A data-race issue exists around sysctl tcp probe interval. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.18.15,...

PT-2022-32938

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.208 Description A data-race issue exists around sysctl tcp probe interval. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.4.208,...

PT-2022-33114

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.290 Description A data-race issue exists around sysctl tcp probe interval. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v4.14.290,...

Malicious code in bfx-facs-interval (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d458c52702055a0bb5c21ebbe239c4b185b8309d2506f24c2961ac0855d42750 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1528 Malicious code in bfx-facs-interval (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d458c52702055a0bb5c21ebbe239c4b185b8309d2506f24c2961ac0855d42750 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-43177

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N...

DEBIAN-CVE-2021-43177

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N...

UBUNTU-CVE-2021-43177

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N...

Devise-Two-Factor 安全漏洞

Devise-Two-Factor is a minimalist extension to Devise. It is used to provide support for two-factor authentication via the TOTP scheme. A security vulnerability in versions of Devise-Two-Factor prior to 4.0.2 allows an attacker to reapply a one-time password OTP to one and only one immediately...

PT-2022-11802 · Unknown +3 · Devise-Two-Factor +3

Name of the Vulnerable Software and Affected Versions: devise-two-factor versions prior to 4.0.2 Description: The issue allows reusing a One-Time-Password OTP for one immediately trailing interval due to an incomplete fix. Recommendations: For versions prior to 4.0.2, update to version 4.0.2 or...

CVE-2022-0864

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraftinterval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting XSS vulnerability...

CVE-2022-0864

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraftinterval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting XSS vulnerability...

PT-2022-13483

Name of the Vulnerable Software and Affected Versions UpdraftPlus WordPress Backup Plugin versions prior to 1.22.9 Description The issue is related to a Reflected Cross-Site Scripting XSS vulnerability. It occurs because the updraft interval parameter is not properly sanitized and escaped before...

SUSE-SU-2022:0845-1 Security update for chrony

This update for chrony fixes the following issues: Chrony was updated to 4.1, bringing features and bugfixes. Update to 4.1 Add support for NTS servers specified by IP address matching Subject Alternative Name in server certificate Add source-specific configuration of trusted certificates Allow...

Reolink RLC-410W device TestEmail out-of-bounds write vulnerability

Summary An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted network request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability. Tested Versions Reolink...