golang: net/http: improper sanitization of Transfer-Encoding header

A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid...

PT-2022-23713 · Ipswitch · Ws Ftp Server

Name of the Vulnerable Software and Affected Versions: WS FTP Server versions prior to 8.7.3 Description: The administrative web interface of WS FTP Server contains multiple reflected cross-site scripting XSS vulnerabilities. A remote attacker can inject arbitrary JavaScript into a WS FTP...

CVE-2022-35917

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

CVE-2022-35917 Weakness in Transfer Validation Logic in @solana/pay

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

CVE-2022-35917 Weakness in Transfer Validation Logic in @solana/pay

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

golang: net/http: improper sanitization of Transfer-Encoding header

A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid...

golang: net/http: improper sanitization of Transfer-Encoding header

A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid...

PT-2022-23023 · Solana · Solana Pay

Name of the Vulnerable Software and Affected Versions: Solana Pay versions prior to 0.2.1 Description: Solana Pay is a protocol that enables developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be...

Malicious user can cause complete loss of function in AxelarAuthWeighted.sol by matching validators and weights to a previous epoch

Lines of code Vulnerability details Impact Complete loss of function for both AxelarAuthWeighted.sol and AxelarGateway.sol Proof of Concept if epochForHashnewOperatorsHash 0 revert SameOperators; AxelarAuthWeighted.soltransferOperatorship reverts in L76 if epochForHashnewOperatorHash != 0. This...

Impossible to transfer VE tokens

Lines of code Vulnerability details Impact In VoteEscrowDelegation.sol, function transferFrom will attempt to remove the delegations to the token transferred. // remove the delegation this.removeDelegationtokenId; However this external call will change msg.sender to addressthis, reverting the cal...

Important: go-toolset:rhel8 security and bug fix update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: compress/gzip: stack exhaustion in Reader.Read CVE-2022-30631 golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705 golang: go/parser: stac...

User is unable to remove delegation and transfer NFT

Lines of code Vulnerability details Impact The transferFrom in VoteEscrowDelegation.sol should be change to an external function. Currently, the function is unable to be called by any user since it is an internal function and there's no call to the function from another Golom contract. With above...

Solana Pay 安全漏洞

Solana Pay is a standard protocol and a set of reference implementations from the Solana Foundation in Switzerland. It enables developers to integrate decentralized payments into their applications and services. A security vulnerability exists in Solana Pay versions prior to 0.2.1 that stems from...

Fedora: Security Advisory for golang-github-schollz-croc (FEDORA-2022-37aef44d1e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for containerd (FEDORA-2022-5ef0bd9a27)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-github-schollz-croc-9.5.2-2.fc36

croc is a tool that allows any two computers to simply and securely transfer files and folders...

[SECURITY] Fedora 36 Update: containerd-1.6.6-5.fc36

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

PT-2022-17393 · Enterprisedb · Enterprisedt Completeftp

Name of the Vulnerable Software and Affected Versions: EnterpriseDT CompleteFTP version 22.1.0 Server Description: This issue allows remote attackers to delete arbitrary files on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the...

Upgraded Q -> M from 268 [1659038665057]

Judge has assessed an item in Issue 268 as Medium risk. The relevant finding follows: The protocol does not support fee on transfer and other weird tokens, e.g.: IERC20rewardToken.safeTransferFrommsg.sender, addressthis, amount; rewardTokenInforewardToken.queuedRewards += amount; --- The text was...

Google Golang 环境问题漏洞

Google Golang is a static, strongly typed, compiled language from Google.The syntax of Go is close to C, but with differences in variable declarations.Go supports garbage collection.Go's parallel model is based on Tony Hall's Communicating Sequential Processes CSP, and other languages with a...