CVE-2022-31778 Transfer-Encoding not treated as hop-by-hop

Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2...

PT-2022-20924 · Apache · Apache Traffic Server

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 9.0.2 Description: The issue is related to improper input validation in handling the Transfer-Encoding header, allowing an attacker to poison the cache. Recommendations: For Apache Traffic Server...

CVE-2022-31778 Transfer-Encoding not treated as hop-by-hop

Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2...

CVE-2022-1705

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid...

CVE-2022-1705

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid...

CVE-2022-1705 Improper sanitization of Transfer-Encoding headers in net/http

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid...

USN-5160-1 mc vulnerability

It was discovered that Midnight Commander would not check server fingerprints when establishing an SFTP connection. If a remote attacker were able to intercept communications this flaw could be exploited to impersonate the SFTP server...

Microsoft Windows Secure Socket Tunneling Protocol 安全漏洞

The Microsoft Windows Secure Socket Tunneling Protocol is a Microsoft mechanism for encapsulating Point-to-Point Protocol PPP traffic via the HTTPS protocol, as specified in RFC1945, RFC2616, and RFC2818. This protocol enables users to access private networks using HTTPS. HTTPS can traverse most...

DEBIAN-CVE-2022-37452

Exim before 4.95 has a heap-based buffer overflow for the alias list in hostnamelookup in host.c when senderhostname is set...

Inadequate transferOwnership function prevents new owner from accessing funds

Lines of code Vulnerability details Description There are two sources of truth for identifying the account that owns a given MIMOProxy: 1. MIMOProxy.owner 2. MIMOProxyRegistry.getCurrentProxyaddress The first source of truth is only used within the proxy contract itself, and the second source of...

MIMOVaultActions Tokens with fee on transfer are not supported

Lines of code Vulnerability details MIMOVaultActions Tokens with fee on transfer are not supported Vulnerability details There are ERC20 tokens that charge fee for every transfer / transferFrom. MIMOVaultActions.soldepositAndBorrow assumes that the received amount is the same as the transfer...

The lazy update of _currentProxies results in non-owners being able to execute functions that require owner privileges

Lines of code Vulnerability details Impact In the MIMOProxyRegistry contract, the getCurrentProxy function returns the address of the mimoProxy contract corresponding to the owner's address in currentProxies. function getCurrentProxyaddress owner external view override returns IMIMOProxy proxy...

Solana Pay Vulnerable to Weakness in Transfer Validation Logic

Description When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient, using the supplied validateTransfer function. An edge case regarding this mechanism could cause the validation logic to validate multiple...

GHSA-J47C-J42C-MWQQ Solana Pay Vulnerable to Weakness in Transfer Validation Logic

Description When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient, using the supplied validateTransfer function. An edge case regarding this mechanism could cause the validation logic to validate multiple...

Functions transferFrom() and transfer() will fail because of commented code

Lines of code Vulnerability details Impact These 2 functions will fail just because the dev forgot to remove the commented code ex / sender / wich is very bad for users. Proof of Concept Tools Used visual Recommended Mitigation Steps remove the / and /. --- The text was updated successfully, but...

Use call() instead of transfer() when transferring ETH in DebtToken

Lines of code Vulnerability details Impact When transferring ETH, use call instead of transfer. The transfer function only allows the recipient to use 2300 gas. If the recipient uses more than that, transfers will fail. In the future gas costs might change increasing the likelihood of that...

Registry not updated when proxy ownership is transferred

Lines of code Vulnerability details Impact When the ownership of a MIMOProxy instance is transferred using the transferOwnership function, the MIMOProxyRegistry contract is not updated, although it is the main entry point of all the workflows, as described in the README.md file. Even after the...

Owner of project NFT has no purpose

Lines of code Vulnerability details Owner of project NFT has no purpose Impact Creating a new project mints a NFT to the sender builder. The builder of a project has special permissions and is required to perform various tasks. However, if the minted NFT is transferred to a different address, the...

Ownership transfer not correctly handled for flash loans

Lines of code Vulnerability details Impact In response to a flashloan, proxyRegistry.getCurrentProxyowner is used to retrieve the correct user proxy and check that this proxy has initiated the flash loan. This can be problematic after ownership transfers of the proxy, where...

Old owner can still set automation / management for vaults after ownership transfer

Lines of code Vulnerability details Impact When the ownership of a user proxy is transferred, proxyRegistry.getCurrentProxy does not reflect this and still returns the proxy for the previous owner. This can be exploited in the access check of setAutomation. Because setManagement has the same chec...