Privilege Escalation

ezsystems/repository-forms is vulnerable to privilege escalation. The vulnerability exists because the company role assigning function is not properly handled which allows an attacker to limit the access of assigning any roles to any user...

PT-2024-11890

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A bug in the Linux kernel has been resolved, specifically in the btrfs qgroup, where a sleep function was called from an invalid context in btrfs qgroup inherit. This issue was reported ...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS when BCast::ToShape is given input larger than an int32, even if it is being supposed to handle up to an int64. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible...

Medium: Vaults can be griefed to not be able to be used for deposits

Lines of code Vulnerability details Description Interaction with SavETHVault and StakingFundsVault require a minimum amount of MINSTAKINGAMOUNT. In order to be used for staking, there needs to be 24 ETH or 4 ETH for the desired BLS public key in those vaults. The issue is that vaults can be grief...

CVE-2022-41890

TensorFlow is an open source platform for machine learning. If BCast::ToShape is given input larger than an int32, it will crash, despite being supposed to handle up to an int64. An example can be seen in tf.experimental.numpy.outer by passing in large input to the input b. We have patched the...

CLSA-2022-1668705928 httpd: Fix of 2 CVEs

CVE-2022-28614: handle large writes in aprputs - CVE-2022-29404: use a liberal default limit for LimitRequestBody of 1GB...

kernel: blk-iolatency: Fix inflight count imbalances and IO hangs on offline

In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix inflight count imbalances and IO hangs on offline iolatency needs to track the number of inflight IOs per cgroup. As this tracking can be expensive, it is disabled when no cgroup has iolatency configured for th...

httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

A flaw was found in httpd, where it incorrectly limits the value of the LimitXMLRequestBody option. This issue can lead to an integer overflow and later causes an out-of-bounds write...

httpd: mod_lua: DoS in r:parsebody

A flaw was found in the modlua module of httpd. A malicious request to a Lua script that calls parsebody0 can lead to a denial of service due to no default limit on the possible input size...

PT-2022-25180 · Wbce Cms · Wbce Cms

Name of the Vulnerable Software and Affected Versions: WBCE CMS affected versions not specified Description: A problematic issue has been found in WBCE CMS, affecting the function increase attempts of the file wbce/framework/class.login.php of the component Header Handler. The manipulation of the...

PT-2022-35879 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.9.332 Description: A possible memory leak was identified in the ehea register port function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prio...

PT-2022-35554 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: The issue is related to a platform-device leak in the bridge platform create function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

Upgraded Q -> M from #215 [1668468272191]

Judge has assessed an item in Issue 215 as M risk. The relevant finding follows: 7. No max fee is set on setFlashLoanFee function There is no max fee set. This allows a malicious owner to set a very high amount of flashloan fee , which allows the malicious admin to grief other users. He can also...

PT-2022-35220 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.77 Description: The issue is related to memory corruption with too many bridges in the drm/msm/dsi component. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

Intel Hyperscan 缓冲区错误漏洞

Intel Hyperscan is a high-performance multi-regular expression matching library from Intel Corporation USA. A security vulnerability exists in versions of Intel Hyperscan prior to 2022/4/29, which stems from improperly limiting buffers. An attacker could exploit the vulnerability to escalate...

Unlimited length of LineOfCredit.ids: storage collisions

Lines of code Vulnerability details Impact There are no restrictions for ids length So malicious borrower may create many credits and replace storage slot data at some position Proof of Concept 1. LineOfCredit.ids saves array size in slot Oracle data feed is insufficiently validated in Oracle.sol...

Potential DoS when closing a credit nominated in ETH in the LineOfCredit contract

Lines of code Vulnerability details When closing a credit that was issued in ETH, the LineOfCredit contract will send the lender his deposit and any accrued interests using the address.transferamount function, which may fail and revert the whole function, leading to an eventual DoS. Impact The...

useAndRepay function can be used to underflow the principal debt of a credit

Lines of code Vulnerability details The function useAndRepay present in the SpigotedLine contract doesn't check that the amount is within the debt limit and can be used by a malicious lender to underflow the principal variable and manipulate the debt of a credit. Impact A malicious lender can use...

## Potential for loops hitting the block gas limit

Lines of code Vulnerability details Proof of Concept A malicious/compromised LineOfCredit arbiter can add a huge amount of collaterals to the Escrow by calling enableCollateral. This method pushes each collateral token to an array that is then iterated over in getCollateralValue. If the array siz...

Amazon Linux 2 : dbus (ALAS-2022-1870)

The version of dbus installed on the remote host is prior to 1.10.24-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1870 advisory. A flaw was found in dbus. The implementation of DBUSCOOKIESHA1 is susceptible to a symbolic link attack. A malicious client...