CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

Rounding loss in and with approxPrice()

Rounding loss in and with approxPrice Description SafEth.approxPrice contains a rounding loss of the form a/k + b/k = ac/b. We would...

Mitigation of M-01: Issue NOT fully mitigated

Mitigated issue M-01: Division before multiplication truncate minOut and incurs heavy precision loss and result in insufficient slippage protection The issue was a loss of precision of three different kinds. 1 a/bc = ac/b in the calculation of mintAmount in SafEth.stake. Mitigation review The...

TIMELOCK OPTION'S DURATION AND MULTIPLIER INACCURATELY DECODED

Lines of code Vulnerability details Impact The implementation of bitwise operations, i.e. and & in decode the timelock option's duration and multiplier does not seem to return results as expected. This could affect all other variables dependent on them. Proof of Concept These affect the function...

K66289873: Apache Tomcat vulnerability CVE-2019-17569

Security Advisory Description The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request...

K57397944: Linux kernel vulnerability CVE-2019-19807

Security Advisory Description In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to sndtimeropen and sndtimercloselocked. The timeri variable was originally intended to be for a newly created timer...

SLASH LOGIC INAPPROPRIATELY IMPLEMENTED

Lines of code Vulnerability details Impact The slash logic in the protocol has overlooked the following two issues: slashminipoolIndex is only called when avaxTotalRewardAmt is equal to 0 which forgoes all other low performing instances even if the node operator has only brought in 1 wei of AVAX...

Shomon - Shodan Monitoring Integration For TheHive

ShoMon is a Shodan alert feeder for TheHive written in GoLang. With version 2.0, it is more powerful than ever! Functionalities Can be used as Webhook OR Stream listener Webhook listener opens a restful API endpoint for Shodan to send alerts. This means you need to make this endpoint available to...

CLSA-2022-1663592078 Fixed CVE-2022-28614 in httpd

CVE-2022-28614: fix out-of-bounds read via aprwrite, refactoring...

CLSA-2022-1663591920 Fixed CVE-2022-28614 in httpd

CVE-2022-28614: fix out-of-bounds read via aprwrite, refactoring...

Fixed CVE-2022-29154 in rsync

CVE-2022-29154: fix arbitrary file write vulnerability via malicious rsync server MITM attack, refactoring - fix test-system components, enable 'daemon' and 'hardlinks' tests...

CLSA-2022-1662658181 Fixed CVE-2022-29154 in rsync

CVE-2022-29154: fix arbitrary file write vulnerability via malicious rsync server MITM attack, refactoring - fix test-system components, enable 'daemon' and 'hardlinks' tests...

CLSA-2022-1662657502 Fixed CVE-2022-29154 in rsync

CVE-2022-29154: refactoring due to broken command line arguments parsing...

CLSA-2022-1662656989 Fixed CVE-2022-29154 in rsync

CVE-2022-29154: refactoring due to broken command line arguments parsing...

Miscalculation for cUSDT and cUSDC

Lines of code Vulnerability details Impact getUnderlyingPrice stated that it would return the underlying price of the assets as a mantissa scaled by 1e18. However, the arithmetic setup on lines 503 and 507 could result in answers not scaled by 1e18. Proof of Concept 1e18 1e18 / 10 decimals is...

[SECURITY] Fedora 36 Update: godoctor-0.6-13.fc36

Go Doctor - The Golang Refactoring Engine...

An Easier Way to Keep Old Python Code Healthy and Secure

Python has its pros and cons, but it's nonetheless used extensively. For example, Python is frequently used in data crunching tasks even when there are more appropriate languages to choose from. Why? Well, Python is relatively easy to learn. Someone with a science background can pick up Python mu...

Fedora: Security Advisory for godoctor (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: godoctor-0.6-12.fc35

Go Doctor - The Golang Refactoring Engine...

Why Developers Hate Changing Language Versions

Progress powers technology forward. But progress also has a cost: by adding new capabilities and features, the developer community is constantly adjusting the building blocks. That includes the fundamental languages used to code technology solutions. When the building blocks change, the code behi...