Demystify Supply Chain Emissions with Akamai’s New Carbon Calculator

Oftentimes, organizations view supply chains as an extension of their own business and require suppliers to adhere to codes of conduct, efficiency standards, and more. Today, this has expanded to environmental sustainability goals as well. Companies understand that the environmental impact of the...

New YVault depositors can be attacked by depressing share decimals

Lines of code Vulnerability details Impact An attacker can become the first depositor for a recently created YVault contract, providing a tiny amount of token by calling deposit1 raw values here, 1 is 1 wei, 1e18 is 1 token if it is 18 decimals. Then the attacker can directly transfer, for exampl...

CVE-2022-24412

Dell EMC PowerScale OneFS 8.2.x - 9.3.0.x contain an improper handling of value vulnerability. An unprivileged network attacker could potentially exploit this vulnerability, leading to denial-of-service...

OSV-2022-336 Use-of-uninitialized-value in grk::N_SCALAR::DecompressIrrev::vtrans

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46594 Crash type: Use-of-uninitialized-value Crash state: grk::NSCALAR::DecompressIrrev::vtrans unsigned long grk::NSCALAR::vscheduler std::1::function::funcunsigned long grk::NSCALAR::vschedulergrk::NSCAL...

Dell Technologies Dell PowerScale OneFS安全漏洞

Dell PowerScale OneFS is a PowerScale OneFS operating system that provides a horizontally scalable NAS. a denial of service vulnerability exists in Dell EMC PowerScale OneFS, which stems from improper handling of value vulnerabilities. An unauthenticated, remote attacker could exploit this...

CVE-2022-27822

Information exposure vulnerability in ril property setting prior to SMR April-2022 Release 1 allows access to EFRUIMID value without permission...

Samsung SMR 安全漏洞

Samsung SMR is a system patch package from South Korea's Samsung Samsung. An information disclosure vulnerability exists in versions prior to Samsung SMR Apr-2022 Release 1, which can be exploited by attackers to cause unauthorized access to the EFRUIMID value...

PT-2022-6194 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: The issue is related to the i740 driver in the Linux Kernel, where a Userspace program can pass any values to the driver through the ioctl interface. The driver does not check the valu...

Need to change the logic of smart contracts in the face of negative inflation

Lines of code Vulnerability details Impact Given that the possibility of negative inflation in the economy is not impossible even now observed in some countries, it is important to clearly explain to users the act of smart contracts against negative inflation. In the current logic of the VOLT...

Possibility of stale and static value of VOLT for longer duration on change of ScalingPriceOracle

Lines of code Vulnerability details If there will be a need for governance action to swap out the ScalingPriceOracle that the OraclePassThrough points to, then it will have to be performed only after 15th till 30/31st of any month. This is due to two constraints viz, 1 28 days TIMEFRAME, and 2 th...

The vulnerability of the Node Set-value module, related to type conversion errors, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Node Set-value module is related to type conversion errors. Exploiting this vulnerability allows an attacker who operates remotely to gain access to confidential data, compromise its integrity, and cause service failures...

Insecure default value for CORS configuration

Impact The default value for the CORSENABLED and CORSORIGIN configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed. Patches The default values for CORS have been changed in...

Autodesk Navisworks Manage PDF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk Navisworks Manage. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-0609

Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Recent assessments: AmirFedida at February 15, 2022 8:23am UTC reported: Google is aware of reports that an exploit for CVE-2022-0609 exist...

Autodesk Navisworks Manage PDF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk Navisworks Manage. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Autodesk Navisworks Manage PDF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk Navisworks Manage. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Autodesk Navisworks Manage PDF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk Navisworks Manage. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

OSV-2022-295 Use-of-uninitialized-value in unsigned long grk::N_SSE4::vscheduler<grk::N_SSE4::DecompressDcShiftIrrev>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46241 Crash type: Use-of-uninitialized-value Crash state: unsigned long grk::NSSE4::vscheduler std::1::function::funcunsigned long grk::NSSE4::vschedulergrk::NSSE4:: tf::Executor::invoke...

PT-2022-10422 · Qualcomm · Snapdragon

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon affected versions not specified Description: The issue is related to a possible out of bound write due to improper validation of the number of timer values received from firmware while syncing timers. This affects various...

Gas costs will likely result in any fees sent to the Splitter being economically unviable to recover.

Lines of code Vulnerability details Impact Collection owners will likely lose money by claiming fees unless the fees from a single NFT sale outweighs the cost of claiming it not guaranteed. Proof of Concept Consider a new Collection with a RoyaltyVault and Splitter set and a nonzero mint fee. Whe...