The vulnerability of the Integration Broker component in the Oracle PeopleSoft Enterprise PeopleTools business application suite allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Integration Broker component in the Oracle PeopleSoft Enterprise PeopleTools business application exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information using the HTTP...

[SECURITY] Fedora 36 Update: curl-7.82.0-8.fc36

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Elrond go 输入验证错误漏洞

Elrond go is an open source go implementation of the Elrond Network protocol by Elrond Network. An input validation error vulnerability exists in Elrond go versions prior to 1.3.34, which stems from a missing function name in MultiESDTNFTTransfer...

possibility of front-run on swap()

Lines of code Vulnerability details Impact The user swapper could lose all their money Proof of Concept 1- the user invokes swap with tokenIn == ohm 2- on this line MINTR.burnOhmaddressthis, amountIn; this user send their money to the TRSRY.sol 3- keeper invoke beat to update the price 4- here...

ERC20 return value not checked and not compatible with tokens like USDT, OMG, etc

Lines of code Vulnerability details ERC20 return value not checked and not compatible with tokens like USDT, OMG, etc Detail The ERC20.transfer and ERC20.transferFrom functions return a boolean value indicating success. This parameter needs to be checked for success. Furthermore, some tokens like...

PVS PXE boot fails: No more network devices / No bootable device

PXE boot fails TFTP transfer after receiving a valid DHCP configuration. Sample failure of this type in screenshot below. Network traces show correct ARP responses going both ways. The target device will not send the first read request unless the ARP response is correct. line 13 in the screenshot...

The vulnerability of the Access Request sub-component of the Oracle iReceivables component in the Oracle E-Business Suite automation system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Access Request subcomponent of the Oracle iReceivables component in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected informati...

The vulnerability of the Infrastructure sub-component of the Oracle FLEXCUBE Universal Banking banking analytics system’s simulation model, allowing a perpetrator to gain access to read, modify, add, or delete data.

The vulnerability of the Infrastructure sub-component of the Oracle FLEXCUBE Universal Banking banking analytics system’s simulation model exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read, modify...

The vulnerability of the Worklist sub-component of the Workflow component in the Oracle E-Business Suite allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the Worklist sub-component of the Workflow component in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using the...

PT-2022-28282 · Unknown · Moment-Timezone

Name of the Vulnerable Software and Affected Versions: moment-timezone versions prior to 0.5.35 Description: The issue arises when using grunt data or grunt release to prepare a custom build of moment-timezone with the latest tzdata from IANA's website. If an attacker intercepts the request to...

While it is allowed to create only one proposal per person, you can still create more

Lines of code Vulnerability details Impact After the creation of one proposal user can send his tokens to another persondelegate votes, so another person will create new proposal using the first user's proposal threshold amount. In propose method there is a condition that one user can create only...

Nouns NFT owner delegating voting power to the zero-address will lock all owned Nouns forever

Lines of code Vulnerability details Impact Nouns NFTs represent governance voting power by having the NounsToken contract inherit the ERC721Checkpointable contract. The ERC721Checkpointable contract is based on the Comp.sol implementation by Compound. One of the modifications is not needing to...

Calling execute function for one proposal immediately after an ETH transfer to timelock contract, such as for another proposal, can steal the transferred ETH

Lines of code Vulnerability details Impact The NounsDAOExecutor contract is the timelock for this protocol. It can receive ETH transfer through the following receive and fallback functions. receive external payable fallback external payable Alice can create a proposal that sends certain amount of...

check if the refundGas() is successful or not

Lines of code Vulnerability details The user can lose their refundAmount in the transaction field Recommended Mitigation Steps Add check bool refundSent, = msg.sender.call value: refundAmount ''; requirerefundSent, "Transfer failed."; --- The text was updated successfully, but these errors were...

Mageia: Security Advisory (MGASA-2022-0294)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-3346-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-37953

An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST v07.09.15 and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantl...

curl: FTP-KRB bad message verification

A vulnerability was found in curl. This issue occurs because it mishandles message verification failures when curl does FTP transfers secured by krb5. This flaw makes it possible for a Man-in-the-middle attack to go unnoticed and allows data injection into the client...

DEBIAN-CVE-2021-4189

A flaw was found in Python, specifically in the FTP File Transfer Protocol client library in PASV passive mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecti...

curl: FTP-KRB bad message verification

A vulnerability was found in curl. This issue occurs because it mishandles message verification failures when curl does FTP transfers secured by krb5. This flaw makes it possible for a Man-in-the-middle attack to go unnoticed and allows data injection into the client...