CVE-2023-28105

CVE-2023-28105 concerns the go-huge-util Go package. A ZipSlip/path-traversal flaw affects versions prior to 0.0.34 when unzipping archives via the fsutil/zip.Unzip function, allowing a malicious zip to escape the target directory. The issue is fixed in 0.0.34; there are no publicly documented wo...

CVE-2023-28105

go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use "zip.Unzip" to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version...

PT-2023-21563 · Unknown · Go-Used-Util

Name of the Vulnerable Software and Affected Versions: go-used-util versions prior to 0.0.34 Description: The issue is a ZipSlip problem that occurs when using the fsutil package to unzip files. This can lead to path traversal when users use zip.Unzip to unzip zip files from a malicious attacker...

CVE-2023-28105: Improper Limitation of a Pathname to a Restricted Directory

go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version...

wrong updating lp position

Lines of code Vulnerability details Impact lock lp token at staking more than required when user adds some lp token staking amount, contract uses new timelockEndTime for previously staked amount . Proof of Concept Scenario : user have some amount of lp token staked for a period of time like 30 da...

CVE-2022-37945

Rejected reason: Not used in 2022...

CVE-2022-37946

Rejected reason: Not used in 2022...

CVE-2022-37947

Rejected reason: Not used in 2022...

CVE-2022-37942

Rejected reason: Not used in 2022...

Open redirect

Rejected reason: Not used in 2022...

Open redirect

Rejected reason: Not used in 2022...

Open redirect

Rejected reason: Not used in 2022...

Open redirect

Rejected reason: Not used in 2022...

Open redirect

Rejected reason: Not used in 2022...

Multiplier must be capped to prevent expected payout exceeding ticket price

Lines of code Vulnerability details Impact Expected payout may be greater than ticket price, bankrupting the lottery. Proof of Concept ticketsSold determines the multiplier to be used when calculating non jackpot rewards LotteryMath.solL84: bonusMulti += excessPot EXCESSBONUSALLOCATION /...

CVE-2021-23950

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues. Notes: none...

CVE-2021-23947

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues. Notes: none...

CVE-2021-23951

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues. Notes: none...

CVE-2021-23943

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues. Notes: none...

K16984: PCRE library vulnerability CVE-2015-2326

Security Advisory Description PCRE library is prone to a vulnerability which leads to Heap overflow. Without enough bound checking inside pcrecompile2, the heap memory could be overflowed via a crafted regular expression. Since PCRE library is widely used, this vulnerability should affect many...