18386 matches found
CVE-2023-29045
Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborati...
After market expires, user can still repay / deposit, but fund are lost
Lines of code Vulnerability details Impact After market expires, user can still repay / deposit, but fund are lost Proof of Concept In OmniToken.sol or OmniTokenNoBorrow.sol user can deposit any time If user borrows token, user can repay from OmniPool.sol any time but the problem is that, after a...
PT-2023-22109 · Ox Software Gmbh +1 · Ox App Suite +2
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Documents operations, specifically "drawing", could be manipulated to contain invalid data types, possibly script code. This script code could be inject...
Mattermost Security Vulnerabilities
Mattermost is an open source collaboration platform from US-based Mattermost. A security vulnerability exists in Mattermost version 5.5.0 and prior versions, which stems from an inability to properly validate a regular expression constructed based on the path to a server URL, resulting in a denia...
Security Bulletin: IBM Rational Build Forge 8.0.0.24 addresses multiple vulnerabilities by updating Apache Tomcat Server
Summary Security Bulletin: IBM Rational Build Forge 8.0.0.24 addresses multiple vulnerabilities by updating Apache Tomcat Server Vulnerability Details CVEID:CVE-2023-28708 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by the missing of secure...
CVE-2020-18770
An invalid memory access flaw was found in the mmapped.c file's zzipdiskentrytofileheader function in Zziplib. This issue could allow an attacker to entice a victim into opening a specially crafted file, leading to a denial of service...
Ubuntu 20.04 LTS : Firefox vulnerabilities (USN-6456-1)
The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6456-1 advisory. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially explo...
OESA-2023-1772 mosquitto security update
Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...
OESA-2023-1774 mosquitto security update
Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...
SUSE CVE-2023-5723
An attacker with temporary script access to a site could have set a cookie containing invalid characters using document.cookie that could have led to unknown errors. This vulnerability affects Firefox 119...
SUSE-SU-2023:4210-1 Security update for jetty-minimal
This update for jetty-minimal fixes the following issues: - Updated to version 9.4.53.v20231009: - CVE-2023-44487: Fixed a potential denial of service scenario via RST frame floods bsc1216169. - CVE-2023-36478: Fixed an integer overflow in the HTTP/2 HPACK decoder bsc1216162. - CVE-2023-40167:...
Sanction Bypass Through Depositing to Authorized Borrower's Market
Lines of code Vulnerability details Impact Wildcat protocol provides lending with lender backed collateral considered as reserves and the ratio must be upheld by the borrower. The protocol team has taken certain steps to prevent interaction with sanctioned users. However, sanction status is only...
PT-2023-26946 · Ashlar Vellum · Ashlar-Vellum Cobalt +4
Name of the Vulnerable Software and Affected Versions: Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share version 12 SP0 Build 1204.77 Description: The affected applications lack proper validation of user-supplied data when parsing XE files, which could lead to an out-of-bounds write. ...
An underflow occurred during the token transfer.
Lines of code Vulnerability details Impact An underflow can occur during a token transfer when there is insufficient allowance. Proof of Concept function transferFrom address from, address to, uint256 amount external virtual nonReentrant returns bool uint256 allowed = allowancefrommsg.sender; //...
GHSA-663W-2XP3-5739 org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
Impact The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid attribute names. This can be exploited, e.g., via the link syntax in any content that supports XWiki syntax like commen...
CVE-2023-5723
An attacker with temporary script access to a site could have set a cookie containing invalid characters using document.cookie that could have led to unknown errors. This vulnerability affects Firefox 119...
CVE-2023-5723
An attacker with temporary script access to a site could have set a cookie containing invalid characters using document.cookie that could have led to unknown errors. This vulnerability affects Firefox 119...
Code injection
An attacker with temporary script access to a site could have set a cookie containing invalid characters using document.cookie that could have led to unknown errors. This vulnerability affects Firefox 119...
CVE-2023-5723
An attacker with temporary script access to a site could have set a cookie containing invalid characters using document.cookie that could have led to unknown errors. This vulnerability affects Firefox 119...