Intel® RST Software August 2022 Security Update

Intel has informed HP of a potential security vulnerability identified in the Intel® Rapid Storage Technology RST software, which might allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Intel has released updates to mitigate the potential...

minGasReserve of MIMOProxy can be overwritten

Lines of code Vulnerability details Impact While there is a check that owner is not changed in a delegatecall, such a check is missing for minGasReserve, which means that the variable can be changed either maliciously or accidentally because of a storage slot collision. The consequences of this a...

Hyperledger: fix(cmd-socketio-server): mitigate cross site scripting attack #2068

Please refer this fix and approve Bounty. See this In Github Security Fix @ryjones https://github.com/hyperledger/cactus/pull/2068issuecomment-1186157206 Impact fixcmd-socketio-server: mitigate cross site scripting attack...

Top 5 Infrastructure as Code Security Challenges

Learn how to counteract the top five challenges of IaC and discover how these obstacles pose a threat to security and gain valuable insight in how to mitigate these risks...

Data Distribution Service: An Overview Part 1

In this three-part blog series, we’ll look into Data Distribution Service, why it is critical, and how you can mitigate risks associated with it...

The LP pair underlying price quote could be manipulated

Lines of code Vulnerability details The LP pair underlying price quote could be manipulated Impact The underlying price for LP pool pair can be manipulated. This kind of price mainpulation happened before, can be found here: Warp Fincance event. Whick may lead to the exploit of the pool by a...

CVE-2022-31106

Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of underscore.deep prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to deepFromFlat, which would pollute any future...

Revert if too many rewardTokens in VE3DLocker

Lines of code Vulnerability details Impact There are a couple logic that iterate rewardTokens, which may run exceed block gas limit if there are too many rewardTokens, potentially freezing reward. Proof of Concept function setApprovals external for uint256 i; i function claimableRewardsaddress...

Patch Your WSO2: CVE-2022-29464 Exploited to Install Linux-Compatible Cobalt Strike Beacons, Other Malware

Users of WSO2 products are advised to update their respective products and platforms or to apply the temporary mitigation steps immediately...

Oracle Linux 8 : grafana (ELSA-2022-1781)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-1781 advisory. - resolve CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache - resolve CVE-2021-43813 grafana: directory traversal vulnerability for...

Russia under Attack from New RURansom Wiper

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here A series of Wiper Malware attacks have been launched in the continuing cyber war between Russia and Ukraine. Researchers have discovered the RURansom wiper malware, which adds to the current collection of harmful malware. The...

sendFundsToUser() does not verify that the user has deposited anything

Lines of code Vulnerability details Impact Users can request arbitrary amounts when requesting funds from the executor, because the deposit hash is not checked against actual deposits. The user can be the executor him/herself if they wish to rug-pull directly. Proof of Concept function...

CVE-2021-26401

LFENCE/JMP mitigation V2-2 may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs...

RangnarLocker Ransomware hits Critical Infrastructure Compromising 50+ Organizations

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Federal Bureau of Investigation FBI has released an alert on Ragnarlocker campaign that has affected nearly 52 organizations encompassing 10 critical infrastructure sectors, including entities in significant manufacturing,...

Intel® MEBx Firmware February 2022 Security Updates

Intel has informed HP of a potential security vulnerability identified in the Intel® Management Engine BIOS eXtensions MEBx which may allow escalation of privilege when provisioning over USB. Intel is releasing firmware updates to mitigate this potential vulnerability. Intel has released updates ...

Reflected XSS vectors in laminas/laminas-form

The package laminas/laminas-form contains a laminas/laminas-view view helper for emitting form element, fieldset, and/or form validation errors, formElementError. Validation messages can contain the original input, potentially resulting in a Reflected XSS vulnerability. Affected versions...

PT-2022-12307 · Coins · Coins Construction Cloud

Name of the Vulnerable Software and Affected Versions: COINS Construction Cloud version 11.12 Description: An issue was discovered due to logical flaws in the human resources interface, making it vulnerable to privilege escalation by HR personnel. Recommendations: For COINS Construction Cloud...

Cisco Releases Patch for Critical Bug Affecting Unified CCMP and Unified CCDM

Cisco Systems has rolled out security updates for a critical security vulnerability affecting Unified Contact Center Management Portal Unified CCMP and Unified Contact Center Domain Manager Unified CCDM that could be exploited by a remote attacker to take control of an affected system. Tracked as...

reset depositTokenAmount in creatorClaimSoldTokens

Handle pauliax Vulnerability details Impact function creatorClaimSoldTokens should nullify depositTokenAmount, otherwise it may not be possible to recover deposit tokens later because the balance will be lower than accounted depositTokenAmount: uint256 excess = ERC20token.balanceOfaddressthis -...

Dutch auction can be manipulated

Handle gzeon Vulnerability details Impact When malt is under-peg and the swing trader module do not have enough capital to buy back to peg, a Dutch auction is triggered to sell arb token. The price of the Dutch auction decrease linearly toward endprice until endAuction is called. endAuction is...