Can force borrower to pay huge interest

Lines of code Vulnerability details Impact The loan amount is used as a min loan amount. It can be matched as high as possible realistically up to the collateral NFT's worth to remain in profit and the borrower has to pay interest on the entire amount instead of just on the desired loan amount wh...

_totalSupply not updated on transferMint/Burn

Handle cmichel Vulnerability details The OverlayToken has a transferMint and transferBurn function which is supposed to act like a transfer followed by a mint/burn. However, a mint/burn updates the totalSupply see mint/burn but these functions do not. Recommended Mitigation Steps The transferMint...

kernel security update

4.18.0-348.2.15.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

GHSA-VRXP-MG9F-HWF3 Improperly Implemented path matching for in-toto-golang

Impact Authenticated attackers posing as functionaries i.e., within a trusted set of users for a layout are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact ...

PT-2021-8278 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the locking mechanism in the Linux kernel, specifically in the queued write lock slowpath function. A reader can acquire the lock without holding the wait lock,...

openSUSE Security Update : flatpak / libostree / xdg-desktop-portal / etc (openSUSE-2021-520)

This update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk fixes the following issues : libostree : Update to version 2020.8 - Enable LTO. bsc1133120 - This update contains scalability improvements and bugfixes. - Caching-related HTTP headers are now supported on summaries and...

EulerOS 2.0 SP5 : golang (EulerOS-SA-2021-1678)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection.CVE-2020-28366 - Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument...

CVE-2021-28305

An issue was discovered in the diesel crate before 1.4.6 for Rust. There is a use-after-free in the SQLite backend because the semantics of sqlite3columnname are not followed...

[SECURITY] Fedora 33 Update: czmq-4.2.1-1.fc33

CZMQ has the following goals: i To wrap the =EF=BF=BD=EF=BF=BDMQ core API in semantics that are natura l and lead to shorter, more readable applications. ii To hide the differences between versions of =EF=BF=BD=EF=BF=BDMQ. iii To provide a space for development of more sophisticated API semantics...

Undefined Behavior

encoding/xml in github.com/golang/go is vulnerable to undefined behavior. The vulnerability is possible because it does not correctly preserve the semantics of directives during tokenization round-trips...

CVE-2020-29510

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

CVE-2020-29509

The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

CVE-2020-29509

The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

Code injection

The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

UBUNTU-CVE-2020-29510

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

CVE-2020-29509

CVE-2020-29509 affects the Go encoding/xml package (all versions) where tokenization round-trips do not preserve attribute namespace prefixes, enabling inputs that behave inconsistently across processing stages in affected downstream applications. Connected sources confirm the vulnerability in Go...

CVE-2020-29510

Removed by vendor...

CVE-2020-29510

CVE-2020-29510 concerns the encoding/xml package in Go versions 1.15 and earlier, where tokenization round-trips fail to preserve directive semantics. This can let an attacker craft inputs that behave differently across processing stages in affected downstream applications. The connected OSV entr...

An issue was discovered in the Linux kernel before 5.7.3 related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation when used for a copy-on-write page does not properly consider the semantics of read operations and therefore can grant unintended write access aka CID-17839856fd58.

...

Linux kernel code issue vulnerability (CNVD-2020-68542)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in versions of Linux kernel prior to 5.7.3, which stems from the presence of an issue related to mm/gup.c and mm/hugememory.c. The getuserpages...