Unsafe transferFrom()

Lines of code Vulnerability details Impact Yieldy.transferFrom returns false on failure instead of reverting. This might lead to moveFundsToUpgradedContract incorrectly unstaking and restaking tokens, potentially causing user or Migration.sol to lose funds depending on NEWCONTRACT and OLDCONTRACT...

com.adobe.cq.wcm:cq-wcm-launches-core (>=5.6.2, <=5.6.8), com.adobe.cq:cq-history (5.6.2) +1 more potentially affected by CVE-2022-32549 via org.apache.sling:org.apache.sling.commons.log (2.0.6)

org.apache.sling:org.apache.sling.commons.log MAVEN version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.sling:org.apache.sling.commons.log and may be impacted: - com.adobe.cq.wcm:cq-wcm-launches-core =5.6.2, =1.0.20, =1.1.10 Source...

CISA Releases Cloud Security Technical Reference Architecture

CISA has released its Cloud Security CS Technical Reference Architecture TRA to guide federal civilian departments and agencies in securely migrating to the cloud. Co-authored by CISA, the United States Digital Service, and the Federal Risk and Authorization Management Program, the CS TRA defines...

Security Bulletin: IBM MQ Internet Pass-Thru is vulnerable to an issue within IBM® Runtime Environment Java™ Technology Edition, Version 7. (CVE-2021-35603)

Summary IBM MQ Internet Pass-Thru has addressed the following vulnerability in the IBM® Runtime Environment Java™ Technology Edition, Version 7 used by IBM MQ Internet Pass-Thru. Vulnerability Details CVEID: CVE-2021-35603 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE...

How to configure Image portability service to migrate an Image to Azure Cloud?

How to configure Image portability service to migrate an Image to Azure Cloud?...

Malicious code in mitui-view-jiveid-migration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd908dae737957b13007e6080479f8a54890d3b5f563a72ffcac0a706048a830 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4637 Malicious code in mitui-view-jiveid-migration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd908dae737957b13007e6080479f8a54890d3b5f563a72ffcac0a706048a830 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-766 Malicious code in @xvideos/migration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7925d97b6deb60cd553d9042f063ee185d32aedeb99da3a1118c68cf9de494b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in roblox-es6-migration-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e6744d30670c11b6c78c162fbf812373252b628ed5af3977d02003b1d7711c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Withdrawing all funds at once to vault can be DoS attacked by frontrunning and locking dust

Lines of code Vulnerability details Impact All funds can be migrated withdrawn at once to the caller vault by using the BaseStrategy.withdrawToVault function which internally calls MyStrategy.withdrawAll. The latter function has the following check in place: MyStrategy.solL184-L187 require...

GHSA-75RW-34Q6-72CR Signature forgery in Biscuit

Impact The paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscu...

Arrow2 allows double free in `safe` code

The struct FfiArrowArray implements deriveClone that is inconsistent with its custom implementation of Drop, resulting in a double free when cloned. Cloning this struct in safe results in a segmentation fault, which is unsound. This derive was removed from this struct. All users are advised to...

GHSA-5J8W-R7G8-5472 Arrow2 allows double free in `safe` code

The struct FfiArrowArray implements deriveClone that is inconsistent with its custom implementation of Drop, resulting in a double free when cloned. Cloning this struct in safe results in a segmentation fault, which is unsound. This derive was removed from this struct. All users are advised to...

7 Facts About Insider Threats That Should Make you Rethink Data Security

In the report, Insider Threats Drive Data Protection Improvements, Forrester Research asserts that most organizations are making positive steps toward protecting the sensitive data they are migrating to the cloud. However, Forrester suggests that many have not devised a comprehensive plan that...

Vulnerabilities fixed in Citrix Application Delivery Manager (ADM).

Citrix has fixed two vulnerabilities in Application Delivery Manager ADM. A malicious person with access to the management environment can exploit the vulnerabilities to cause a denial-of-service by disabling the License service, or to gain access to a root shell, by forcing a reset on the...

PT-2025-8580

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue occurs when tasks are moved across cgroups during migration, and some tasks are involved in identity noop migrations whil...

PT-2022-20491

Name of the Vulnerable Software and Affected Versions Biscuit versions 1 Description The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. This would allow an attacker to create a token with any access level. The version 2 of...

Xen race condition vulnerabilities

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in all...

Ubuntu: Security Advisory (USN-5467-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5467-1 linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-azure-fde, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities

It was discovered that the Linux kernel did not properly restrict access to the kernel debugger when booted in secure boot environments. A privileged attacker could use this to bypass UEFI Secure Boot restrictions. CVE-2022-21499 Aaron Adams discovered that the netfilter subsystem in the Linux...