CVE-2021-41251

@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations. In affected versions and in some...

Security update for mailman (important)

openSUSE Security Update: Security update for mailman Announcement ID: openSUSE-SU-2021:1436-1 Rating: important References: 1047218 1191959 1191960 Cross-References: CVE-2021-42096 CVE-2021-42097 CVSS scores: CVE-2021-42096 SUSE: 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-42097...

Front-running displacement to beat oracle updates for price manipulation

Handle hack3r-0m Vulnerability details For off-chain oracle, consider: A broadcasted transaction tx1 from a trusted oracle/s changes the price from X to X + d or X -d, this knowledge of update can be harmful and leveraged by malicious actors. If one had to transfer Y amount at current state after...

CLSA-2021-1635459350 Fix CVE(s): CVE-2021-23017

SECURITY UPDATE: Off-by-one in ngxresolvercopy when labels are followed by a pointer to a root domain name - debian/patches/fix-off-by-one-heap-write-vulnerability.patch - CVE-2021-23017...

CLSA-2021-1635459227 Fix CVE(s): CVE-2021-2154, CVE-2021-2342, CVE-2021-2169, CVE-2021-2179, CVE-2021-2226, CVE-2021-2307, CVE-2021-2166, CVE-2021-2146, CVE-2021-2162, CVE-2021-2385, CVE-2021-2390, CVE-2021-2194, CVE-2021-2372, CVE-2021-2171, CVE-2021-2389, CVE-2021-2180

SECURITY UPDATE: Update to 5.7.35 to fix security issues - CVE-2021-2342, CVE-2021-2372, CVE-2021-2385, CVE-2021-2389, CVE-2021-2390, CVE-2021-2146, CVE-2021-2154, CVE-2021-2162, CVE-2021-2166, CVE-2021-2169, CVE-2021-2171, CVE-2021-2179, CVE-2021-2180, CVE-2021-2194, CVE-2021-2226, CVE-2021-2307...

Errors logging off the endpoints while having active published apps - “CGPPowerNotifWndCls: wfica23.exe – Application error”

Users are reporting an error when logging off from their workstations while havingactive published app sessions The users are not closing the published app before logging off the Worksstation. Users utilize Windows 10 machines with Imprivata to badge-in/badge-out Agent 6.3. When they badge in,...

NewStart CGSL CORE 5.05 / MAIN 5.05 : ntp Vulnerability (NS-SA-2021-0142)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ntp packages installed that are affected by a vulnerability: - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofe...

NewStart CGSL CORE 5.05 / MAIN 5.05 : dnsmasq Multiple Vulnerabilities (NS-SA-2021-0183)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has dnsmasq packages installed that are affected by multiple vulnerabilities: - A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service memory...

NewStart CGSL CORE 5.05 / MAIN 5.05 : bind Multiple Vulnerabilities (NS-SA-2021-0153)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has bind packages installed that are affected by multiple vulnerabilities: - In BIND 9.0.0 - 9.11.21, 9.12.0 - 9.16.5, 9.17.0 - 9.17.3, also affects 9.9.3-S1 - 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on...

CLSA-2021-1634922789 Fixed CVE-2021-23017 in nginx

Fixed CVE-2021-23017 : Off-by-one in ngxresolvercopy when - labels are followed by a pointer to a root domain name...

Exploit for Off-by-one Error in Sudo_Project Sudo

CVE-2021-3156 CVE-2021-3156 exploit Introducti...

UserManager: debtWriteOff() function doesn't update state in comptroller

Handle itsmeSTYJ Vulnerability details Thoughts The debtWriteOff function calls updateTotalFrozen instead of updateTotalFrozen. It is not clear if the comptroller's state should also be updated if totalStaked is modified which it is when you write debt off. If it is then updateTotalFrozen should ...

TA505 Gang Is Back With Newly Polished FlawedGrace RAT

The TA505 cybercrime group is whirring its financial rip-off machinery back up, pelting malware at a range of industries in what was initially low-volume waves that researchers saw spiral up late last month. They do bad things, but they’re so tricky that tracking them is a ton of fun, said Sherro...

CVE-2021-20322

A flaw in the processing of received ICMP errors ICMP fragment needed and ICMP redirect in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest...

PrizePool.awardExternalERC721() Erroneously Emits Events

Handle leastwood Vulnerability details Impact The awardExternalERC721 function uses solidity's try and catch statement to ensure a single tokenId cannot deny function execution. If the try statement fails, an ErrorAwardingExternalERC721 event is emitted with the relevant error, however, the faile...

Exploit for Off-by-one Error in Sudo_Project Sudo

PoC exploit for CVE-2021-3156, an exploit module targeting the WangluoAnquan framework. The exploit is designed to demonstrate the vulnerability in the framework's UploadHandler.ashx component, which allows for arbitrary file uploads. The exploit uses a simple form submission to upload a maliciou...

ConcentratedLiquidityPoolHelper.getTickState reverts

Handle cmichel Vulnerability details ConcentratedLiquidityPoolHelper.getTickState allocates only tickCount elements for the ticks array. But the while loop iterates over all ticks of the pool which can potentially become very large, much larger than any tickCount could iterate in a reasonable tim...

CVE-2021-41123

Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to any user. None of the survey answers are ever exposed, only the aggregate counters, including count of interviews, or count of assignments...

Encrypted & Fileless Malware Sees Big Growth

A full 91.5 percent of malware was delivered using HTTPS-encrypted connections in the second quarter, researchers said, making attacks more evasive. That’s according to WatchGuard Technologies’ latest report on findings within its telemetry, which also found that these detections come primarily...

CVE-2021-38398

The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker with physical access to the affected device could exploit these vulnerabilities...