GHSA-5XM4-JMPW-P6J3 Ansible discloses credential information

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the deb...

Ether can be locked in the ConvexCurveLPVault contract without a way to retrieve it

Lines of code Vulnerability details Impact If a borrower deposits Curve LP tokens into the ConvexCurveLPVault contract via the payable function GeneralVault.depositCollateraladdress asset, uint256 amount and accidentally sends a non-zero Ether value with it, then the Ether value sent will be lock...

GHSA-JC7P-5R39-9477 Improper Input Validation in Apache Tomcat

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a...

PermissionlessBasicPoolFactory\addPool() doesn’t check whether pool.excessBeneficiary is address(0)

Lines of code Vulnerability details Impact In PermissionlessBasicPoolFactory\addPool, it doesn’t check whether pool.excessBeneficiary is address0. Therefore, when doing withdrawExcessRewards. IERC20pool.rewardTokensi.transferpool.excessBeneficiary, rewards always revert. Proof of Concept...

pl.fishprocessinglines.com Cross Site Scripting vulnerability OBB-2601636

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Vulnerabilities fixed in Oracle Financial Services Applications

Oracle has fixed vulnerabilities in the following Financial Services applications: - Oracle Banking Deposits and Lines of Credit Servicing - Oracle Banking Enterprise Default Management - Oracle Banking Loans Servicing - Oracle Banking Party Management - Oracle Banking Payments - Oracle Banking...

Staked Citadel function balance and reportHarvest

Lines of code Vulnerability details Impact In the StakedCitadel...

The vulnerability of the nmakehlp.c component in the Tcl programming language allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Tcl programming language component nmakehlp.c is related to insufficient handling of format lines. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures through a specially created file...

QA Report

Paladin Contest March 31, 2022 @securerodd Non-Critical 1. Inconsistent Removal of Bonus Multiplier The bonus multipliers userCurrentBonusRatiouser and userBonusRatioDecreaseuser are zeroed out in the kickaddress user, address kicker and unlockaddress user functions where an empty lock is set...

Gibber can take any amount from safes

Lines of code Vulnerability details Impact Although Gibber is supposed to behind governance timelock, there are still significant "rug risk" when such privillaged user can remove all fund from a vault unconditionally. Proof of Concept function gibaddress to, uint256 assetAmount external...

CLSA-2022-1644855718 Fix of CVE: CVE-2022-0351, CVE-2022-0368, CVE-2022-0359, CVE-2022-0361

CVE-2022-0351: fix crash caused by too depth recursion - CVE-2022-0359: fix illegal memory access with large tabstop in ex mode - CVE-2022-0361: fix illegal memory access when copying lines in visual mode - CVE-2022-0368: fix illegal memory access when undo makes visual area invalid...

Fix of CVE: CVE-2022-0351, CVE-2022-0368, CVE-2022-0359, CVE-2022-0361

CVE-2022-0351: fix crash caused by too depth recursion - CVE-2022-0359: fix illegal memory access with large tabstop in ex mode - CVE-2022-0361: fix illegal memory access when copying lines in visual mode - CVE-2022-0368: fix illegal memory access when undo makes visual area invalid...

CLSA-2022-1643637259 Fix CVE(s): CVE-2017-12424, CVE-2018-7169

SECURITY UPDATE: Crash or buffer overflow - debian/patches/CVE-2017-12424.patch: fix buffer overflow if NULL line is present in db in lib/commonio.c. - CVE-2017-12424 SECURITY UPDATE: Access to privileged information - debian/patches/CVE-2018-7169.patch: newgidmap: enforce setgroups=deny if...

CVE-2022-0156

It was found that vim was vulnerable to use-after-free flaw in the way it was treating allocated lines in user functions. A specially crafted file could crash the vim process or possibly lead to other undefined behaviors...

[SECURITY] Fedora 35 Update: dvdauthor-0.7.2-16.fc35

DVDAuthor is a set of tools to help you author the file and directory structure of a DVD-Video disc, including programmatic commands for implementing interactive behavior. It is driven by command lines and XML control files, though there are other programs that provide GUI-based front ends if you...

stb 安全漏洞

stb is a single-file public domain library for C/C. stbimage.h is one of the image loaders. stb stbimage.h contains a security vulnerability that stems from the HDR loader parsing truncated file-tailed RLE scan lines into an infinitely long zero-length sequence. An attacker could cause a denial o...

July 2021 Security Releases

July 2021 Security Releases Security releases available Updates are now available for v16.x, v14.x, and v12.x Node.js release lines for the following issue. We normally like to give advance notice and provide releases in which the only changes are security fixes, but since this vulnerability was...

Critical Juniper Bug Allows DoS, RCE Against Carrier Networks

A critical remote code-execution vulnerability in Juniper Networks’ Steel-Belted Radius SBR Carrier Edition lays open wireless carrier and fixed operator networks to tampering. The SBR Carrier server is used by telecom carriers to manage policies for how subscribers access their networks – by...

Security update for ucode-intel (important)

openSUSE Security Update: Security update for ucode-intel Announcement ID: openSUSE-SU-2021:1933-1 Rating: important References: 1179833 1179836 1179837 1179839 Cross-References: CVE-2020-24489 CVE-2020-24511 CVE-2020-24512 CVE-2020-24513 CVSS scores: CVE-2020-24489 NVD : 8.8...

What is the WireGuard VPN protocol?

In layman’s terms, a VPN uses encryption to create a private online connection between a device and a VPN server. With a good VPN service, you can shield your data from curious eyes. A VPN protocol is the set of rules that shapes how your data travels between your computer, mobile phone, tablet, ...