pool-x.de Cross Site Scripting vulnerability OBB-3615818

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Vault will stop participating in draws in case if they deposited maximum assets to the underlying vault

Lines of code Vulnerability details Impact Vault will stop participating in draws in case if they deposited maximum assets to the underlying vault. Proof of Concept Vault contract has maxMint function. This function first checks allowed amount to mint in the PtVault and then also checks amount...

XenCenter fails to remove host from the Pool

Removal of a Hypervisor from a Pool when XenCenter fails...

Exploit for Improper Input Validation in Microsoft

CVE-2023-36899 The CVE-2023-36899 vulnerability involves a b...

GHSA-7VXC-Q7RV-QFJ8 SUCHMOKUO node-worker-threads-pool denial of service Vulnerability

An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3 that allows attackers to cause a denial of service. This can be mitigated by manually creating a timeout. For example: ts const StaticPool = require"node-worker-threads-pool"; const staticPool = new...

@blockmatic/eosio-ship-reader (>=0.3.0, <=1.2.0), @kongkong21/eosio-ship-reader (>=1.3.0, <=1.3.1) +4 more potentially affected by CVE-2021-29057 via node-worker-threads-pool (1.4.3)

node-worker-threads-pool NPM version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on node-worker-threads-pool and may be impacted: - @blockmatic/eosio-ship-reader =0.3.0, =1.3.0, =1.0.0, =0.0.2, =0.0.1, =1.0.53 Source cves: CVE-2021-29057 Source...

CVE-2021-29057

An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service...

Denial of service

An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service...

PT-2023-12132

Name of the Vulnerable Software and Affected Versions SUCHMOKUO node-worker-threads-pool version 1.4.3 Description An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool, allowing attackers to cause a denial of service. This issue can be mitigated by manually creating a...

CVE-2021-29057

CVE-2021-29057 affects node-worker-threads-pool v1.4.3 via the StaticPool component, enabling a denial-of-service condition. Descriptions across multiple sources confirm the DoS impact but do not provide deep technical exploit details beyond that a DoS can be triggered. A practical mitigation men...

node-worker-threads-pool Resource Management Error Vulnerability

node-worker-threads-pool is a simple worker threads pool using Node's workerthreads module by MOKUO Personal Developer. A security vulnerability exists in node-worker-threads-pool version 1.4.3, which stems from a security issue that allows an attacker to cause a denial of service DoS by exploiti...

CVE-2021-29057: Uncontrolled Resource Consumption

An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service...

CVE-2021-29057

An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service...

curl: GSS delegation too eager connection re-use

A flaw was found in the Curl package. Libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, the GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting...

PT-2023-4293

Name of the Vulnerable Software and Affected Versions ASP.NET affected versions not specified Description The issue is related to an elevation-of-privilege vulnerability in ASP.NET, which allows attackers to affect the system. This vulnerability is associated with insufficient access controls in...

Inflation attacks with virtual shares and assets on GeVault

Lines of code Vulnerability details Impact An inflation attacks can be done on the first deposit into the GeVault contract. Making the first real depositor losing his deposit. Proof of Concept Inflation attack steps : First, Alice the attacker need to craft a deposit that put valueX8 = 1 = Thus...

Lack of authentication in rngComplete

Lines of code Vulnerability details Impact In RngRelayAuction.sol the rngComplete function is meant to be called only by the rngAuctionRelayer contract, however, it can currently be called by any user. Consequently any random number can be used to close a prize pool draw, benefiting the malicious...

function rngComplete is unpprotected

Lines of code Vulnerability details Impact The rngComplete is a function Called by the relayer to complete the Rng relay auction. However it has zero access control. Proof of Concept The function makes calls to the prizepool to close a draw, it also withdraws from a reserve. All these are done wi...

manipulate rate

Lines of code Vulnerability details Impact using spot price as the exchange rate can be manipulated. Proof of Concept 1. attacker manipulates the balancer pool making eth very expensive 2. By calling the updateCache function, the attacker updates the cachedCalculatedAmount based on the manipulate...

rate is wrong

Lines of code Vulnerability details Impact attacker can manipulate pool price to make strategy have eth lower as it should have 1 seth 1 eth then mint new steth 1 steth = 1 eth so attacker can gain share more than normal Proof of Concept 1. attacker manipulate pool price 1 seth 1 eth 2. attacker...