Insecure Ownership Management in DNSSECImpl.sol

Lines of code Vulnerability details Impact This finding highlights a potential security risk related to the lack of safeguards when changing ownership in the DNSSECImpl.sol contract. As it stands, the current implementation allows for the owner to be set to address0, which could result in the los...

DNS wire format AND DNS label-sequence format ARE USED INTERCHANGABLY TO REPRESENT DOMAIN NAMES DURING RRSet VALIDATION

Lines of code Vulnerability details Impact @param name The name to claim, in DNS wire format. above format is used in DNSRegistrar.proveAndClaim and DNSRegistrar.proveAndClaimWithResolver functions @param name The name of the RRSIG record, in DNS label-sequence format. above format is used in...

Invalid addresses will be accepted as resolvers, possibly bricking assets

Lines of code Vulnerability details Description The hexToAddress utility parses a string into an address type. function hexToAddress bytes memory str, uint256 idx, uint256 lastIdx internal pure returns address, bool if lastIdx - idx 40 return address0x0, false; bytes32 r, bool valid =...

BytesUtils.keccak does not revert when offset is out of bounds

Lines of code Vulnerability details Impact The BytesUtils.keccak function accepts out of bound offset value and returns a valid response without reverting. function keccak bytes memory self, uint256 offset, uint256 len internal pure returns bytes32 ret requireoffset + len = self.length; assembly...

Anyone can call enableNode and set a node resolver

Lines of code Vulnerability details Impact The lack of access control allows anyone to call the enableNode function and set the ENS resolver to the resolver set in DNSRegistrar if it has not been set before, or it belongs to the previous registrar set on the contract. This results in any unset no...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and Integration Runtime operands that run Designer flows containing a Box node may be vulnerable to arbitrary code execution due to [CVE-2023-29199]

Summary Node.js module vm2 is used by IBM App Connect Enterprise Certified Container for communications with Box via the Box connector. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run Designer flows containing a Box node may be vulnerable ...

Unvalidated External Library Usage in RSASHA256Algorithm

Lines of code Vulnerability details Impact A hacker could exploit this vulnerability to inject malicious code into the contract, potentially allowing them to steal user funds or take control of the contract. Proof of Concept To demonstrate the attack vector, lets deploy a malicious version of the...

SHA1Digest Contract Vulnerability

Lines of code Vulnerability details Impact The vulnerability is related to the use of the SHA1 hashing algorithm in the SHA1Digest contract. SHA1 is an outdated cryptographic hash function that has been deprecated by most security experts due to its weaknesses and susceptibility to collision...

Upgraded Q -> 3 from #883 [1682591277339]

Judge has assessed an item in Issue 883 as 3 risk. The relevant finding follows: As such, if deposit or withdraw reverts for any derivative, stake and unstake will fail. This could cause stake and unstake to permanently revert for an prolonged period of time, as it is possible for deposit and...

WordPress Orbit Fox by ThemeIsle Plugin < 2.10.24 is vulnerable to Server Side Request Forgery (SSRF)

Software Orbit Fox by ThemeIsle Type Plugin Vulnerable versions 2.10.24 Fixed in 2.10.24 OWASP Top 10 A3: Sensitive Data Exposure Classification Server Side Request Forgery SSRF CVE CVE-2023-2287 Patch priority Medium CVSS severity Medium 5.5 Developer Claim ownership PSID b60604d1a545 Credits Al...

PT-2023-3041

Name of the Vulnerable Software and Affected Versions ReportLab versions up to 3.6.12 Description The issue is related to the rl safe eval function in the ReportLab library, which is associated with incorrect code generation management. This can allow a remote attacker to bypass security...

CVE-2021-41803

A flaw was found in HashiCorp Consul, where it is vulnerable to a denial of service caused by improper input validation for the node or segment names. By sending a specially-crafted request, a remote, authenticated attacker can cause a denial of service. Mitigation Mitigation for this issue is...

Update your PaperCut application servers now: Exploits in the wild

PaperCut, maker of print management solutions, has urged product users to update as soon as possible. A security vulnerability which exploits unpatched servers has been seen in the wild, with serious ramifications for any organisation impacted. Two specific vulnerabilities are at the heart of thi...

CVE-2023-26735

blackboxexporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources. NOTE: this is disputed by third parties because authentication can be configured...

The domain owner can transfer ownership of their domain to another individual and ownership of the domain can be returned

Lines of code Vulnerability details Impact The domain owner can transfer ownership of their domain by utilizing the setOwner function within the ENSRegistry.sol contract. In doing so, the original domain owner forfeits complete ownership of the domain. But, the original owner can regain ownership...

A DNS owner can sell the domain and then regain it back using a signature while he was still the owner of the domain

Lines of code Vulnerability details Impact The buying user would have spent money buying the DNS domain to the previous owner and still not have the DNS domain under their ownership. Proof of Concept A malicious user can: Build a proof for their ownership of a dns domain setting their address in...

CVE-2023-0045

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ibprctlset function updates the Thread Information Flags TIFs for the task and updates the SPECCTRL MSR on the function speculationctrlupdate, but the IBPB is only issued on the next...

CVE-2023-25815 Git looks for localized messages in the wrong place

In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the gettext function's implicit initialization no...

Imperva Unveils Latest API Security Enhancements

Imperva is continuing to evolve its API Security offering to help customers better protect their APIs, wherever they are, and to meet changing market requirements. Since launching API Security in March 2022, we continued investing in our API Security offering with the goal of simplifying the...

WordPress Everest News Theme <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Everest News Type Theme Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27421 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c15b03e345f4 Credits László Radnai Required...