CVE-2022-46402

The Microchip RN4870 module firmware 1.43 and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112 accepts PairConrmSend with incorrect values...

Funds will be lost if the contract handling the refunds are unable to handle them at the moment

Lines of code Vulnerability details The return values of low-level calls are not checked Impact If the fund transfer results in a revert on the recipient's end, e.g. due to being paused, the code will continue on as if it had been successful, and the Ether will be lost. Proof of Concept Return...

K16863: Apache vulnerability CVE-2013-5704

Security Advisory Description The modheaders module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in...

CLSA-2022-1671123986 curl: Fix of CVE-2022-32221

CVE-2022-32221: fix issue when POST following PUT confusion - fix the contents of some test suites: replace the unsupported variable TESTNUMBER with a real value...

CVE-2022-3104

An issue was discovered in the Linux kernel through 5.16-rc6. lkdtmARRAYBOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc and will cause the null pointer dereference...

DEBIAN-CVE-2022-41915

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling DefaultHttpHeadesr.set with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to...

UBUNTU-CVE-2022-41915

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling DefaultHttpHeadesr.set with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to...

Linux kernel 代码问题漏洞

The Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A code issue vulnerability exists in the Linux kernel that stems from unchecked devmkzalloc return values and null pointer dereferences...

Siemens SCALANCE X-200RNA Switch Devices

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity/public exploits available Vendor: Siemens Equipment: SCALANCE Vulnerabilities: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS, Uncontrolled Resource Consumption, Use of...

Linux kernel 代码问题漏洞

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A code issue vulnerability exists in the Linux kernel that stems from a null pointer dereference due to unchecked kzalloc return values...

CVE-2022-41915

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling DefaultHttpHeadesr.set with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to...

Rapid7 Recognized as a Top Place to Work for 11th Consecutive Year

On November 30th, 2022, Rapid7 was again recognized by The Boston Globe as a Top Place to Work in Massachusetts. This marks the 11th consecutive year Rapid7 has made the list, this time coming in at 3 in the large company category. Top Places to Work rankings are based on a Globe survey that...

CVE-2022-46684

Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting in a stored cross-site scripting XSS vulnerability...

CVE-2022-2642

Horner Automation’s RCC 972 firmware version 15.40 contains global variables. This could allow an attacker to read out sensitive values and variable keys from the device...

CVE-2022-2642

Horner Automation’s RCC 972 firmware version 15.40 contains global variables. This could allow an attacker to read out sensitive values and variable keys from the device...

Use wrong reserve values in Pool.addLiquidity()

Lines of code Vulnerability details Impact When doing Pool.addLiquidity, it would call bin.addLiquidity to add liquidity to the bins. And the calculation in bin.addLiquidity should be based on the amount of new tokens and the bin’s existing reserves. However, Pool.addLiquidity uses temp.deltaA an...

depositAndTrade::exactInputSingleParams the possible return values not checked

Lines of code Vulnerability details Impact The return values ​​from collateral.deposit and collateral.transferFrom are not used. This means that the values ​​returned by those functions will not be stored or used in the code. The swapRouter.exactInputSingle function also likely returns no value, ...

Owner can rug PrePOMarket using re-initialized finalLongPayout.

Lines of code Vulnerability details Description In PrePOMarket.sol, the finalLongPayout represents the finalized value of a single long token in the market. It is settled post ICO / IPO according to predetermined rules. The issue is that this value may be re-initialized as many times as owner...

Overflow in BinMap can break pool

Lines of code Vulnerability details Impact The BinMap library performs multiplication on int32 values that can potentially overflow and cause the corresponding function calls to revert. The functions in question are used by essential Pool methods such as Pool.addLiquidity or Pool.swap and an...

Debian dla-3237 : node-tar - security update

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3237 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3237-1 [email protected]...