Fedora: Security Advisory for containerd (FEDORA-2022-230f2b024b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Money Transfer Management System 跨站脚本漏洞

A cross-site scripting vulnerability exists in Money Transfer Management System version 1.0, a money transfer management system. The vulnerability stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to execute...

Money Transfer Management System SQL注入漏洞

Money Transfer Management System is a remittance management system. version 1.0 of Money Transfer Management System is vulnerable to SQL injection, which stems from a lack of validation of external input SQL statements in the id parameter of mtms/admin/?page=transaction/viewdetails. An attacker...

Money Transfer Management System SQL注入漏洞

A SQL injection vulnerability exists in Money Transfer Management System version 1.0, a money transfer management system. The vulnerability stems from missing validation of external input SQL statements in the id parameter in admin/maintenance/managebranch.php and admin/maintenance/managefee.php...

[SECURITY] Fedora 35 Update: containerd-1.6.1-1.fc35

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

[SECURITY] Fedora 34 Update: containerd-1.6.1-1.fc34

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

Malicious User can Manipulate PreCT Mint Logic with Direct Base Token Transfer

Lines of code Vulnerability details Impact A bad actor can steal funds from future depositors by sending the base token directly to the Strategy or StrategyController contracts. This exploit is more effective the less shares that have already been distributed, perhaps early into the launch of the...

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker who controls the HTTP server to make the client script enter an infinite loop consuming CPU time. The highest threat from this vulnerability is to system availability.

...

The vulnerability of the Oracle Access Manager component of the Oracle Fusion Middleware software allows a perpetrator to execute arbitrary code.

The vulnerability of the Oracle Access Manager component of the Oracle Fusion Middleware software is related to errors in processing http requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Fee-on-transfer/deflationary tokens cause problems

Lines of code Vulnerability details Some ERC20 tokens, such as USDT, allow for charging a fee any time transfer or transferFrom is called. If a contract does not allow for amounts to change after transfers, subsequent transfer operations based on the original amount will revert due to the contrac...

ALPINE-CVE-2022-22720

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling...

Missing allowlist checks on tokens in CrossAnchorBridge could cause loss of funds

Lines of code Vulnerability details Impact The CrossAnchorBridge contract accepts any ERC20 token and transfers them to the wormhole bridge. There were allowlist checks on the tokens before, but they were commented out in this version for the audit. If a user transfers, for example, non-supported...

bETH rewards can be timed

Lines of code Vulnerability details Impact The bETH reward contract allocates new rewards sent to the contract whenever updateglobalindex is called. It should be possible to time the transfer of the rewards to the contract and frontrun it with increasing one's token balance to capture more reward...

Inconsistency behavior between bAsset tokens and the standard cw20 tokens

Lines of code Vulnerability details Impact The implementation of the send function of bAsset tokens is inconsistent with the standard cw20's implementation. In the standard implementation, the msg and the transfer amount are passed to the recipient contract as a regular message. However, in the...

Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding

Summary: The llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS. Description: When Node receives the following request: http GET / HTTP/1.1 Transfer-Encoding: chunked , identity 1 a 0 it...

Conti Ransomware Group Diaries, Part III: Weaponry

Part I of this series examined newly-leaked internal chats from the Conti ransomware group, and how the crime gang dealt with its own internal breaches. Part II explored what its like to be an employee of Contis sprawling organization. Todays Part III looks at how Conti abused popular commercial...

The vulnerability of the web interface of NETGEAR RAX43 integrated software routers allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the web interface of NETGEAR RAX43 router software relates to the transmission of data in an open manner. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information through HTTP requests...

The vulnerability of the RouterOS operating system in MikroTik routers allows a hacker to cause a service failure.

The vulnerability of the RouterOS operating system for MikroTik routers lies in the fact that operations are performed outside of the buffer in memory. Exploiting this vulnerability allows a malicious actor to cause a service failure through a specially crafted FTP request...

There is a possibility of Token transfer getting stuck when using Erc1155BatchMessage

Lines of code Vulnerability details Impact In the event of user error while making the calldata for encodeTransferErc1155BatchMessage, where the size of the arrays of ids and amounts donot match, the message will get encoded due to no input validation, however the transfer will fail at the other...

Schain owners can rug pull users' funds

Lines of code Vulnerability details Impact Once a chain has been killed the chain owner is able to call getFunds on each of the deposit boxes and transfer funds/tokens wherever he/she wishes Even if the owner is benevolent the fact that there is a rug vector available may negatively impact the...