Use of deprecated Chainlink API

Handle 0xRajeev Vulnerability details Impact The contracts use Chainlink’s deprecated API latestAnswer. Such functions might suddenly stop working if Chainlink stopped supporting deprecated APIs. Impact: Deprecated API stops working. Prices cannot be obtained. Protocol stops and contracts have to...

Test configuration carryover to production deployment limits pool users to 5

Handle 0xRajeev Vulnerability details Impact The project uses a data structure for indexing ticket tokens/users called SortitionSumTreeFactory which as explained in the overview video time 14:20-14:50 is used to capture users’ token balances in the leaves where internal nodes represent their sums...

Critical uberOwner address changes should be a two-step process

Handle 0xRajeev Vulnerability details Impact As specified, uberOwners of Factory, Orderbook and Treasury have the highest privileges in the system because they can upgrade contracts of market, Nfthub, order book, treasury, token and factory which form the critical components of the protocol. The...

Important: Red Hat Security Advisory: dotnet5.0 security and bugfix update

An update for .NET 5.0 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Missing zero-address check for the beneficiary address

Handle 0xRajeev Vulnerability details Impact The beneficiary address specified in constructor receives all the proceeds from NFT sales which could be of significant value. However, there is no zero-address validation of this beneficiary address parameter during initialization in the constructor...

USDV functions can be called before initialization in init() of USDV.sol

Handle 0xRajeev Vulnerability details Impact All the external/public functions of USDV.sol can be called by other contracts even before USDV.sol contract is initialized. This can lead to exceptions, state corruption or incorrect accounting in other contracts, which may require redeployment of...

Initialization can be front-run in USDV.sol

Handle 0xRajeev Vulnerability details Impact Given the public access, this is susceptible to front-running by an attacker who can initialize this with arbitrary assets before the deployer. Reinitialization will require contract redeployment because initialization can be done only once. Reference:...

Vader functions can be called before initialization in init() of Vader.sol

Handle 0xRajeev Vulnerability details Impact All the external/public functions of Vader.sol can be called by other contracts even before Vader.sol contract is initialized. This can lead to exceptions, state corruption or incorrect accounting in other contracts, which may require redeployment of...

Initialization can be front-run in DAO.sol

Handle 0xRajeev Vulnerability details Impact Given the public access, this is susceptible to front-running by an attacker who can initialize this with arbitrary assets before the deployer. Reinitialization will require contract redeployment because initialization can be done only once. Reference:...

Pool functions can be called before initialization in init() of Pools.sol

Handle 0xRajeev Vulnerability details Impact All the external/public functions of Pools.sol can be called by other contracts even before Pools.sol contract is initialized. This can lead to exceptions, state corruption or incorrect accounting in other contracts, which may require redeployment of...

2 0 1 4 years 1 months 2 9, Kloxo vulnerability: the Default directory to upload and external DDOS attack-vulnerability warning-the black bar safety net

This is an urgent situation, KLOXO proof important security issues, malicious visitors by KLOXO panel Default directory for incoming malicious PHP code部分 如 default.php, the actual control of the machine toDDoSattackreferred to as the contract, resulting in the VPS or server, network congestion, t...

How to log in to the Linux Helper Appliance

Purpose This article documents how to login to the Linux appliance used by Veeam Backup & Replication. This is not a common need, but may be neccesary for troubleshooting or advanced configuration. Linux appliances are used by Veeam Backup & Replication for several purposes: In Surebackup, the...

CVE-2007-0415

BEA WebLogic Server 8.1–8.1 SP5 is affected by an access-control bypass after dynamic update/redeployment of applications implemented as exploded jars. The vulnerability allows bypassing intended restrictions, but the provided documents do not specify a fix/patch version or a workaround. Exploita...

CVE-2005-1744

BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role...

CVE-2005-1744

The CVE concerns BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5, where a redeploy does not log out users. This allows continued access to the application without re-authentication, potentially violating newly changed security constraints or role mappings. The issue is documen...

BEA WebLogic Server fails to discard cached authentication information when web applications are updated

Overview The BEA WebLogic server contains a vulnerability that may allow authenticated users to bypass authentication for a given web application when the application has been updated. Description The BEA WebLogic Server provides a feature that allows it to store user authentication information f...