[SECURITY] Fedora 37 Update: keyring-ima-signer-0.1.0-9.fc37

The IMA Integrity Measurement Architecture is a key component of the Linux integrity subsystem designed to ensure integrity, authenticity, and confidentiality of systems including hardware root of trusts TPM. This tool allows signing of files in userspace, inclusding options of including the...

[SECURITY] Fedora 38 Update: keyring-ima-signer-0.1.0-9.fc38

The IMA Integrity Measurement Architecture is a key component of the Linux integrity subsystem designed to ensure integrity, authenticity, and confidentiality of systems including hardware root of trusts TPM. This tool allows signing of files in userspace, inclusding options of including the...

kernel security and bug fix update

An update is available for kernel. This update affects Rocky Linux SIG Cloud 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux...

kernel security and bug fix update

An update is available for kernel. This update affects Rocky Linux SIG Cloud 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux...

Wrong logic at Fed.resign()

Lines of code Vulnerability details Impact The Fed contract has resign function which sets the chair address to address0. The NATSPEC states that this function is useful for immediately removing chair powers in case of a wallet compromise. Since the chair wallet is a multisig wallet, in the event...

UBUNTU-CVE-2022-42961

An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via ...

An admin can revoke the claim of a given claimant at any time then withdraw the claim due to said claimant.

Lines of code Vulnerability details Impact I understand the reasoning why admins are given the ability to revoke claims but that power in combination with the fact that an admin can then withdraw said claim that was due to a claimant gives rug vibes. This ability should at least be behind a...

CVE-2022-20345

In l2cbleprocesssigcmd of l2cble.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12...

the customers can’t just trust the admin

Lines of code Vulnerability details The users can’t just trust the admin eve with multi-sig. So the admin can on anytime change the lenderFee to 100% just by calling replaceLenderFee Recommended Mitigation Steps Add a maximum value for lenderFee to ensure that the admin can’t update the lenderFee...

kernel security and bug fix update

3.10.0-1160.59.1.OL7 - Update Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 = 15-2.0.9 - Update oraclekernel-sig-key...

[WP-H0] DEFAULT_ADMIN_ROLE of BribeVault can steal tokens from users' wallets

Lines of code Vulnerability details The current design/implementation allows the DEFAULTADMINROLE of BribeVault to steal funds from any address that approved this contract up to allowance: As a DEFAULTADMINROLE, the attack is simply do the following steps: 1. grantDepositorRole to self; 2...

Possible griefing attack on vault setStrategy

Handle harleythedog Vulnerability details Impact In the function setStrategy within Vault.sol, there is a requirement that strategy.investedAssets == 0 so that no funds are left stuck in the strategy. A malicious user could strategically transfer 1 wei of underlying to the strategy or any other...

[SECURITY] Fedora 33 Update: bluez-5.60-1.fc33

Utilities for use in Bluetooth applications: - hcitool - hciattach - hciconfig - bluetoothd - l2ping - rfcomm - sdptool - bluetoothctl - btmon - hcidump - l2test - rctest - gatttool - start scripts Red Hat - pcmcia configuration files - avinfo The BLUETOOTH trademarks are owned by Bluetooth SIG,...

Bluetooth SQL Injection Vulnerability

Bluetooth is a short-range wireless technology standard from the Bluetooth Special Interest Group SIG standards organization for exchanging data between fixed and mobile devices over short distances using UHF radio waves in the ISM band from 2.402 GHz to 2.48 GHz, and for building Personal Area...

Multiple Bluetooth Core Specification Vulnerabilities - Lenovo Support US

No description provided...

CVE-2020-15357

CVE-2020-15357 affects the Askey AP5100W_Dual_SIG_1.01.097 and all prior versions. The vulnerability involves remote command execution via a shell metacharacter in the options for ping, traceroute, or route, indicating a shell injection in network-analysis functionality. The connected documents c...

Askey AP5100W Dual SIG Operating System Command Injection Vulnerability

The Askey AP5100W Dual SIG is a router from Askey Electronics Technology China. A security vulnerability in the Askey AP5100W Dual SIG 1.01.097 and all prior versions can be exploited by remote attackers to execute arbitrary commands via ping, traceroute, or shell metacharacters in the routing...

Askey AP5100W Dual SIG Security Vulnerability

The Askey AP5100W Dual SIG is a router from Askey China. A security vulnerability exists in the Askey AP5100W Dual SIG version 1.01.097 and earlier, which stems from the use of weak passwords in the Askey AP5100W Dual SIG. An attacker can exploit the vulnerability to gain unauthorized access...

GHSA-X5CP-9PCF-PP3H Denial of Service in Tensorflow

Impact The RaggedCountSparseOutput does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the splits tensor has the minimum required number of elements. Code uses this quantity to initialize a different data structure:...

sig-germany.de Cross Site Scripting vulnerability OBB-1345845

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...