CVE-2018-25074: Inefficient Regular Expression Complexity

A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The manipulation of the argument uri leads to inefficient regular expression complexity. The patch is named...

The Frax ETH liquid staking protocol WRONGLY assumes that the users can convert their sfrxETH for more frxETH over time

Lines of code Vulnerability details Impact The Frax ETH liquid staking protocol WRONGLY assumes that the users can convert their sfrxETH for more frxETH over time.But because of any untoward incident if the validators stake can gets slashed, then this assumption will be wrong and can cause severe...

[SECURITY] Fedora 36 Update: golang-github-envoyproxy-protoc-gen-validate-0.4.1-7.fc36

Protoc plugin to generate polyglot message validators...

Fedora: Security Advisory for golang-github-envoyproxy-protoc-gen-validate (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-github-envoyproxy-protoc-gen-validate-0.4.1-6.fc36

Protoc plugin to generate polyglot message validators...

Malicious code in prop-validators (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 208823f77227ee7ce0ddb2250eff9a0f1c0b1c93919dc9c90b7c03e52a669696 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Missing check in the updateValset function

Lines of code Vulnerability details Impact The updateValset function don't check that the sum of the powers of the new validators in the new valset is greater than the threshold, which can lead to unwanted behavior. There are 2 main problems that can occur in that situation: 1. The sum of the new...

it's possible that validators don't have enough power

Lines of code Vulnerability details newValset parameter in updateValset can have validators that don't have enough power combined for passing the threshold. Recomendation mitigation steps check that the validators power combined is bigger than the threshold --- The text was updated successfully,...

Rugpull vector : a single admin address can withdraw all funds

Lines of code Vulnerability details Impact Someone with access to admin keys could rug pull all funds Proof of Concept The gravity.sol contract should work as an escrow to mint equivalent tokens in the cosmos chain. This is maintained by a system of validators. The possible decentralization of th...

Fedora: Security Advisory for golang-github-envoyproxy-protoc-gen-validate (FEDORA-2022-08ae2dd481)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-github-envoyproxy-protoc-gen-validate-0.4.1-5.fc36

Protoc plugin to generate polyglot message validators...

Fedora: Security Advisory for golang-github-envoyproxy-protoc-gen-validate (FEDORA-2022-5cbd6de569)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: golang-github-envoyproxy-protoc-gen-validate-0.4.1-5.fc35

Protoc plugin to generate polyglot message validators...

Frourio input validation error vulnerability

Frourio is a fast and type-safe full-stack framework for TypeScript. frourio is vulnerable to an input validation error, which stems from the failure of the validator in the product validators/ directory to validate input data, and could be exploited to cause the validator to not work properly fo...

Expression Language Injection in Netflix Conductor

Netflix Conductor uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being...

Improper Input Validation

frourio is vulnerable to improper input validation. The vulnerability exists due to improper input validation within the class-validator function through the validators/ folder in the index.ts file, which allows an attacker to bypass security...

CVE-2022-23624

Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through "validators/" folder are subject to a input validation vulnerability. Validators do not work properly for request...

Frourio-express 输入验证错误漏洞

Frourio-express is a fast and type-safe full-stack framework for TypeScript. An input validation error vulnerability exists in Frourio-express, which stems from the validator in the product validators/ directory not validating input data. The following products and versions are affected:...

Frourio 输入验证错误漏洞

Frourio is a fast and type-safe full-stack framework for TypeScript. frourio is vulnerable to an input validation error, which stems from the failure of the validator in the product validators/ directory to validate input data, and could be exploited to cause the validator to not work properly fo...

Cronos 安全漏洞

Cronos is a Crypto.org Evm chain. Designed to massively scale the DeFi ecosystem. Cronos suffers from a security vulnerability that stems from the fact that in Cronos nodes running versions prior to v0.6.5, it is possible to collect transaction fees for the current block from the Cosmos SDK's...