8949 matches found
WordPress plugin demon image annotation 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
CVE-2022-3882
CVE-2022-3882 concerns the WordPress WP Memory plugin prior to 2.46. The vulnerability is a lack of proper authorization and CSRF protection in an AJAX action, allowing any authenticated user (e.g., a subscriber) to call the action and install/activate arbitrary plugins from wordpress.org. Connec...
user's funds lock and incorrect code behavior because users withdrawal amount won't get reset for all users in each userPeriodLength in WithdrawHook contract
Lines of code Vulnerability details Impact according to the comments in code: "Every time userPeriodLength seconds passes, the amount withdrawn for all users will be reset to 0" . but in current implementation only one of the users userToAmountWithdrawnThisPeriod value gets reset and this will...
A whale user is able to cause freeze of funds of other users by bypassing withdraw limit
Lines of code Vulnerability details Description In Collateral.sol, users may withdraw underlying tokens using withdraw. Importantly, the withdrawal must be approved by withdrawHook if set: function withdrawuint256 amount external override nonReentrant uint256 baseTokenAmount = amount...
Unlimited Global & User Withdrawal right after previous period ends and new period begins
Lines of code Vulnerability details Impact Checks for Global and User Withdraw Limit Per Period are missing for the first withdrawal request right AFTER period length expires and a new period begins. First withdrawal request amount after period length expires can be way higher than...
[NAZ-M2] Usage of send() Can Result In Revert
Lines of code Vulnerability details Impact Several functions are sendusing is used by the across several functions to transfer ETH/WETH. send uses a fixed amount of gas, which was used to prevent reentrancy. However this limit your protocol to interact with others contracts that need more than th...
SUSE-SU-2022:4398-1 Security update for go1.18
This update for go1.18 fixes the following issues: Update to version 1.18.9, includes the following security fixes: - CVE-2022-41717: net/http: limit canonical header cache by bytes, not entries bsc1206135 - CVE-2022-41720: os, net/http: avoid escapes from os.DirFS and http.Dir on Windows bsc1206...
Rewards are not accounted for properly in NTokenApeStaking contracts, limiting user's collateral.
Lines of code Vulnerability details Description ApeStakingLogic.sol implements the logic for staking ape coins through the NTokenApeStaking NFT. getTokenIdStakingAmount is an important function which returns the entire stake amount mapping for a specific BAYC / MAYC NFT. function...
httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
A flaw was found in httpd, where it incorrectly limits the value of the LimitXMLRequestBody option. This issue can lead to an integer overflow and later causes an out-of-bounds write...
GSD-2022-1007991 netfilter: ipset: enforce documented limit to prevent allocating huge memory
netfilter: ipset: enforce documented limit to prevent allocating huge memory This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.78 by commit...
snakeyaml: Denial of Service due to missing nested depth limitation for collections
A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service DoS due to missing nested depth limitation for collections...
Upgraded Q -> M from #76 [1670347574630]
Judge has assessed an item in Issue 76 as M risk. The relevant finding follows: L02 address.callvalue:x should be used instead of payable.transfer Impact The use of payable.transfer is heavily frowned upon because it can lead to the locking of funds. The transfer call requires that the recipient...
GHSA-X45C-CVP8-Q4FM Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace
Capsule implements a multi-tenant and policy-based environment in a Kubernetes cluster. A ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operato...
Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace
Capsule implements a multi-tenant and policy-based environment in a Kubernetes cluster. A ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operato...
CrossChainRelayerArbitrum contract gas limit bug
Lines of code Vulnerability details Summary The CrossChainRelayerArbitrum contract uses the maxSubmissionCost parameter to determine if the gasLimit provided to the processCalls function is greater than the maxGasLimit. This is incorrect because maxSubmissionCost should not be used to determine t...
Possible DoS On executeCalls() function
Lines of code Vulnerability details Impact The contract can be in a state of DoS as the function executeCalls would consume all the gas as there is no upper limit on the number of calls that can be inside the array calls. Proof of Concept In the function here it perform a for loop and loops throu...
Incorrect gas limit check
Lines of code Vulnerability details Summary The relayCalls function incorrectly checks the gas limit provided in the gasLimit parameter against the maxGasLimit variable instead of checking if it is less than or equal to the msg.gas value. Impact This bug allows the caller of relayCalls to specify...
CrossChainRelayerArbitrum contract: GasLimitTooHigh revert error not caught
Lines of code Vulnerability details Summary The relayCalls function in the CrossChainRelayerArbitrum contract reverts when the gasLimit parameter is greater than the maxGasLimit, but it does not have a catch block to handle the error. As a result, the transaction will fail without providing any...
CVE-2022-46167 Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule...