CVE-2021-40896

A Regular Expression Denial of Service ReDOS vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails...

CVE-2021-40896

CVE-2021-40896 affects that-value v0.1.3, with a Regular Expression Denial of Service when validating crafted invalid emails. Affected component: that-value (Python/JS validator package as per sources). Root cause: ReDOS vulnerability described in multiple entries (NVD/Red Hat/CNVD) as a flaw in ...

CVE-2021-40896

A Regular Expression Denial of Service ReDOS vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails...

that-value 安全漏洞

that-value is a multilingual platform validator package by the individual developer Paweł Stefański, Poland. A Regular Expression Denial of Service ReDOS vulnerability exists in that-value version v0.1.3, which can be exploited by an attacker to cause a denial of service when validating a crafted...

PT-2022-11324 · Unknown · That-Value

Name of the Vulnerable Software and Affected Versions: that-value version 0.1.3 Description: A Regular Expression Denial of Service ReDOS vulnerability was discovered in that-value when validating crafted invalid emails. Recommendations: For that-value version 0.1.3, update to a version that fixe...

In Notional case Redeemer's redeem() will not do the position redeeming

Lines of code Vulnerability details Currently no actual redeeeming is done in Notional case as maxRedeem is a balance view function that doesn't close the position. This way one more operation, the redeeming itself, is now committed and in Notional case Redeemer's redeem doesn't perform anything,...

Sense AMM address can be manipulated, allowing unlimited mint of principal tokens

Lines of code Vulnerability details Lender's lend for Sense uses ISensex.swapUnderlyingForPTs output to determine the Illuminate PT amount to be minted for the user. x is a user supplied and not verified address, which can be precooked by a malicious user to return any inflated amount, that will ...

GHSA-W24X-87MR-4R23 SpEL Injection in Spring Data MongoDB

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized...

Missing notBoughtOut modifier

Lines of code Vulnerability details Impact On the withdrawUnsettledBids function, unsettledBid can be withdraw when buyout is rejected. However, the contract is missing notBoughtOut modifier in the function. From that reason, during buyout period the function can be called. On the redeem function...

CVE-2022-33114

Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinalcms/system/dict/list...

PYSEC-2022-43059

AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service DoS. NOTE: multiple third parties dispute this issue because there is no example of a context in which denial of service would occur, and many common contexts have exception handing in the...

CLSA-2022-1655901847 Fix CVE(s): CVE-2022-2042

SECURITY UPDATE: Using uninitialized value and freed memory in spell command - debian/patches/CVE-2022-2042.patch: Initialize "attr" and check for empty line early - CVE-2022-2042...

Fixed CVE-2022-2042 in vim

CVE-2022-2042: fix using uninitialized value and freed memory in spell command...

CLSA-2022-1655901379 Fixed CVE-2022-2042 in vim

CVE-2022-2042: fix using uninitialized value and freed memory in spell command...

EulerOS 2.0 SP8 : libtiff (EulerOS-SA-2022-1937)

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile...

PT-2022-21701 · Aiohttp · Aiohttp

Name of the Vulnerable Software and Affected Versions: AIOHTTP version 3.8.1 Description: The issue concerns a potential Denial of Service DoS due to an invalid IPv6 URL, which can lead to a "ValueError: Invalid IPv6 URL" outcome. However, multiple third parties dispute this issue, citing a lack ...

Defending Against Scheduled Task Attacks in Windows Environments

Scheduling tasks is one of the most popular attack techniques used by threat actors to establish persistence on a victim’s machine. The Qualys Research Team investigated different ways that attackers could use to conceal scheduled tasks. In this blog, we describe three new techniques to hide and...

Incorrect hard coded value for WETH address

Lines of code Vulnerability details Impact getWETHAddress still relies on same Comp hard coded address. Unless WETH address is deployed to an address identical to Comps original address the grantCompinternal function wont work or in a pessimistic scenario an attacker might deploy a malicious toke...

SUSE-FU-2022:2135-1 Feature update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Make sure SaltCacheLoader use correct fileclient bsc1199149 - Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9...

Wrong initial value of exitFees and EntryFees

Lines of code Vulnerability details Impact L49/53/159/167 - The exitFees and entryFees variables can only have values ​​between 1 and 10000, which represent 0.01% and 100%, but since it is not set in the constructor, the default value is 0, a value that is incorrect. Recommended Mitigation Steps ...