8033 matches found
Memory corruption
Memory corruption while running NPU, when NETWORKUNLOAD and NETWORKUNLOAD or NETWORKEXECUTEV2 commands are submitted at the same time...
Rust EVM Security Vulnerability
Rust EVM is an Ethernet virtual machine interpreter. A security vulnerability exists in Rust EVM 0.41.0 and earlier versions, which stems from the recordexternaloperation function falsely interacting with the stack, resulting in the presence of incorrect return values...
PT-2024-18980 Ā· Rust-Evm Ā· Rust-Evm
Name of the Vulnerable Software and Affected Versions: rust-evm versions prior to 0.41.1 Description: The issue is related to the record external operation feature in rust-evm, which allows library users to record custom gas changes. This feature can have bogus interactions with the call stack,...
Restore Entire Bucket to Zadara Object Storage Fails With "Error: Internal error: object key is empty."
Challenge Attempting to perform an Entire Bucket Restore with the the Destination set to New Bucket when using Zadara Object Storage fails with the error: Restore job failed Error: Internal error: object key is empty. ClientId: , BucketName: Cause This issue arises from a problem related to the...
MOXA ioLogik E1200 Series Cross-Site Request Forgery Vulnerability
MOXA ioLogik E1200 Series is a series of general-purpose controllers and I/O devices from MOXA, China. The MOXA ioLogik E1200 Series suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to submit a special request, obtain sensitive information or perform a...
Most Sophisticated iPhone Hack Ever Exploited Apple's Hidden Hardware Feature
The Operation Triangulation spyware attacks targeting Apple iOS devices leveraged never-before-seen exploits that made it possible to even bypass pivotal hardware-based security protections erected by the company. Russian cybersecurity firm Kaspersky, which discovered the campaign at the beginnin...
Bandook a 2007 Legacy Still Thriving in the Threat Landscape
Summary: The Bandook malware is a persistent remote access trojan RAT that surfaced in 2007. Programmed in Delphi and C++, it has evolved through various iterations over the years and has historical associations with Dark Caracal. It featured prominently in a campaign dubbed āOperation Manulā...
After upgrade to 14.1 ADC GUI response is slow resulting in operation timeout with tacacs auth
After upgrading Citrix ADC to version 14.1-8.50 from version 13.1, users are facing management GUI access issue with Tacacs authentication. Almost all pages are opening very slowly and are giving error Operation timeout. Disabling RbaOnResponse resolves the issue as a workaround...
Friday Squid Blogging: Squid Parts into Fertilizer
Its squid parts from college dissections, so its not a volume operation. As usual, you can also use this squid post to talk about the security stories in the news that I havenāt covered. Read my blog posting guidelines here...
PT-2023-31745 Ā· Totolink Ā· Totolink Ex1200T
Name of the Vulnerable Software and Affected Versions: TOTOlink EX1200L version 9.3.5u.6146 B20201023 Description: The issue allows for arbitrary command execution via the "cstecgi.cgi" interface, specifically through the setOpModeCfg function. This could potentially be exploited through the...
TOTOLINK EX1200L å®å Øę¼ę“
TOTOLINK EX1200L is a dual-band wireless signal booster, mainly used to extend Wi-Fi coverage in home or office environments, solving the problem of weak signals or dead spots. The TOTOLINK EX1200L suffers from a command execution vulnerability that stems from the setOpModeCfg interface of...
DEBIAN-CVE-2023-7042
A null pointer dereference vulnerability was found in ath10kwmitlvoppullmgmttxcomplev in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a denial of service...
German Authorities Dismantle Dark Web Hub 'Kingdom Market' in Global Operation
German law enforcement has announced the disruption of a dark web platform called Kingdom Market that specialized in the sales of narcotics and malware to "tens of thousands of users." The exercise, which involved collaboration from authorities from the U.S., Switzerland, Moldova, and Ukraine,...
When the returnNative parameter is set to true in the _params provided to MoneyMarketHook.execute, it is not handled properly and could disrupt user expectations
Lines of code Vulnerability details Impact When param.returnNative is set to true while calling MoneyMarketHook.execute, users expect the returned token from the withdraw operation to be in native form and sent to the caller. However, in the current implementation, this is not considered and coul...
_handleRepay of MoneyMarketHook does not consider the actual debt shares of the posId inside the position manager and could lead to a user's tokens getting stuck inside the hook.
Lines of code Vulnerability details Impact When users construct repay operations via MoneyMarketHook, it doesn't consider the actual debt shares of the position inside the InitCore and PosManager. This could lead to users' tokens getting stuck inside the MoneyMarketHook contract. Proof of Concept...
Lack of receive() inside MoneyMarketHook contract when interacting with WNATIVE.
Lines of code Vulnerability details Impact MoneyMarketHook is expected to work with the native balance when interacting with WNATIVE, especially when params.returnNative is set to true during the execute operation. However, due to the lack of a receive function inside the contract, MoneyMarketHoo...
Error Handling in '_createAuction' Function
Lines of code Vulnerability details Potential Risk: The 'createAuction' function attempts to mint a new Verb by calling the 'verbs.mint' function. However, it lacks proper error handling for the minting process. If the minting operation fails e.g., due to insufficient gas or other reasons, the...
3,500 Arrested in Global Operation HAECHI-IV Targeting Financial Criminals
A six-month-long international police operation codenamed HAECHI-IV has resulted in the arrests of nearly 3,500 individuals and seizures worth $300 million across 34 countries. The exercise, which took place from July through December 2023, took aim at various types of financial crimes such as...
Using block.timestamp as the deadline/expiry invites MEV
Lines of code 307 Vulnerability details Passing block.timestamp as the expiry/deadline of an operation does not mean "require immediate execution" - it means "whatever block this transaction appears in, I'm comfortable with that block's timestamp". Providing this value means that a malicious mine...
Underflow could happened when calculating Uniswap V3 position's fee growth and can cause operations to revert
Lines of code Vulnerability details Impact When operations need to calculate Uniswap V3 position's fee growth, it used similar function implemented by uniswap v3. However, according to this known issue : Uniswap/v3-core573. The contract is implicitly relies on underflow/overflow when calculating...