DefaultMaxSwapAmount is 10x higher than spec for ETH

Lines of code Vulnerability details Impact In the "coinswap" module a limit is in place for avoiding large swaps and their potential to manipulate the price in a low-liquidity scenario. The spec says: For risk management purposes, a swap will fail if the input coin amount exceeds a pre-defined...

Upgraded Q -> 2 from #16 [1686928129422]

Judge has assessed an item in Issue 16 as 2 risk. The relevant finding follows: L-3 onlyOwner single point of failure Impact The onlyOwner role has a single point of failure and onlyOwner can use critical a few functions. Even if protocol admins/developers are not malicious there is still a chanc...

EulerOS Virtualization 3.0.6.0 : NetworkManager (EulerOS-SA-2023-2227)

According to the versions of the NetworkManager packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An off-by-one Error issue was discovered in Systemd in formattimespan function of time-util.c. An attacker could supply...

EulerOS Virtualization 3.0.6.0 : systemd (EulerOS-SA-2023-2233)

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A use-after-free vulnerability was found in systemd. This issue occurs due to the onstreamio function and dnsstreamcomplete...

Huawei EulerOS: Security Advisory for NetworkManager (EulerOS-SA-2023-2227)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for systemd (EulerOS-SA-2023-2233)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle timeout at rebalance will result in a sell-off of all RSRs at 0 price

Lines of code Vulnerability details When creating the trade for rebalance, the RecollateralizationLibP1.nextTradePair uses uint192 low, uint192 high = rsrAsset.price; // UoA/tok to get the rsr sell price. And the rsr assert is a pure Assert contract, which price function will just return 0, FIXMA...

CVE-2023-29402 Code injection via go command with cgo in cmd/go

The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved...

Security Bulletin: CVE-2022-3821 may affect IBM CICS TX Advanced 10.1

Summary CVE-2022-3821 may affect IBM CICS TX Advanced 10.1. IBM CICS TX Advanced 10.1 has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2022-3821 DESCRIPTION: systemd is vulnerable to a denial of service, caused by an off-by-one error in formattimespan function of time-util.c. By...

PT-2025-38376

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue in modpost related to an off-by-one error in the is executable section function. A comparison should be = to prevent an out-of-bounds array access...

New PowerDrop Malware Targeting U.S. Aerospace Industry

An unknown threat actor has been observed targeting the U.S. aerospace industry with a new PowerShell-based malware called PowerDrop. "PowerDrop uses advanced techniques to evade detection such as deception, encoding, and encryption," according to Adlumin, which found the malware implanted in an...

New PowerDrop Malware Targeting U.S. Aerospace Industry

An unknown threat actor has been observed targeting the U.S. aerospace industry with a new PowerShell-based malware called PowerDrop. "PowerDrop uses advanced techniques to evade detection such as deception, encoding, and encryption," according to Adlumin, which found the malware implanted in an...

EulerOS Virtualization 2.11.0 : systemd (EulerOS-SA-2023-2113)

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An off-by-one Error issue was discovered in Systemd in formattimespan function of time-util.c. An attacker could supply specific...

Important: libtasn1

Issue Overview: GNU Libtasn1 before 4.19.0 has an ETYPEOK off-by-one array size check that affects asn1encodesimpleder. CVE-2021-46848 Affected Packages: libtasn1 Issue Correction: Run dnf update libtasn1 --releasever 2023.0.20230607 or dnf update --advisory ALAS2023-2023-201 --releasever...

EulerOS Virtualization 2.11.1 : systemd (EulerOS-SA-2023-2061)

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An off-by-one Error issue was discovered in Systemd in formattimespan function of time-util.c. An attacker could supply specific...

Huawei EulerOS: Security Advisory for systemd (EulerOS-SA-2023-2113)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The Console Does Not Appear After Being Launched

Challenge After launching the Veeam Backup & Replication Console, the splash screen appears, and the application is shown in the taskbar, but the Console does not appear, and the mouseover preview is blank. Cause The Console's window position is off the edge of the screen. When the Veeam Backup &...

Qualcomm Chipsets Resource Management Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that stems from memory corruption due to post-release usage in the core when multiple DCI clients are enrolled and logged off...

Brazilian Cybercriminals Using LOLBaS and CMD Scripts to Drain Bank Accounts

An unknown cybercrime threat actor has been observed targeting Spanish- and Portuguese-speaking victims to compromise online banking accounts in Mexico, Peru, and Portugal. "This threat actor employs tactics such as LOLBaS living-off-the-land binaries and scripts, along with CMD-based scripts to...

Amazon Linux 2 : qemu (ALAS-2023-2061)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2061 advisory. A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write...