Add a timelock to functions that set key variables

Handle s1m0 Vulnerability details Impact Functions like setLeveragePercent and setLiquidationThresholdPercent for both IsolatedMarginTrading and CrossMarginTrading should be put behind a timelock because they would give more trust to users. Now the owner could call them whenever he wants and a...

The vulnerability of the Cisco IOS XE software’s command-line interface allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Cisco IOS XE software’s command-line interface is related to the existence of an undocumented feature in command input fields that allows for the manipulation of variable values. Exploiting this vulnerability could enable a perpetrator to compromise the confidentiality an...

lastUpdatedDay not initialized

Email address [email protected] Handle gpersoon Eth address gpersoon.eth Vulnerability details The variable lastUpdatedDay in IncentiveDistribution.sol is not properly initialized. This means the function updateDayTotals will end up in a very large loop which will lead to an out of gas error. Eve...

Debian DLA-2613-1 : underscore security update

node-underscore and libjs-underscore are vulnerable to Arbitrary Code Execution via the template function, particulary when a variable property is passed as an argument as it is not sanitized. For Debian 9 stretch, this problem has been fixed in version 1.8.3dfsg-1+deb9u1. We recommend that you...

CVE-2021-23358

A flaw was found in nodejs-underscore. Arbitrary code execution via the template function is possible, particularly when a variable property is passed as an argument as it is not sanitized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

CVE-2021-23358

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized...

CVE-2021-23358

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized...

CVE-2021-23358 Arbitrary Code Injection

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized...

CVE-2021-23358

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized...

OESA-2021-1095 grub2 security update

GNU GRUB is a Multiboot boot loader. It was derived from GRUB, the GRand Unified Bootloader, which was originally designed and implemented by Erich Stefan Boleyn. Briefly, a boot loader is the first software program that runs when a computer starts. It is responsible for loading and transferring...

PT-2021-5689 · Microsoft · Sharepoint Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: The issue is related to the implementation of the Microsoft.SharePoint.WorkflowActions.SetVariableActivity class in Microsoft SharePoint Foundation, SharePoint Server, a...

pki-core security and bug fix update

10.5.18-12 - Change variable 'TPS' to 'tps' - - RHEL 7.9: - - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates profiles, audit for IPA edewata - - Backported CVEs ascheel: - - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token parameters in TPS resulting in stored...

USN-4791-1 tomcat7 vulnerabilities

It was discovered that Apache Tomcat 7 did not protect applications from the presence of untrusted client data in an environment variable. A remote attacker could possible use this vulnerability to redirect the traffic to an arbitrary proxy and obtain sensitive information. CVE-2016-5388 It was...

The installers of E START products may insecurely load Dynamic Link Libraries

Overview The installers of E START products by GMO INSIGHT Inc. contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries in the folder specified by the TEMP environment variable or where the installer resides CWE-427, CVE-2015-9267, and CVE-2015-9268...

Untrusted Object Deserialization

Qcubed is vulnerable to untrusted object deserialization. An attacker is able to inject untrusted PHP object of the POST-variable “strProfileData” and execute code via a malicious POST request...

grub2: Stack buffer overflow in grub_parser_split_cmdline()

A flaw was found in grub2. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with...

grub2: Stack buffer overflow in grub_parser_split_cmdline()

A flaw was found in grub2. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with...

grub2: Stack buffer overflow in grub_parser_split_cmdline()

A flaw was found in grub2. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with...

grub2: Stack buffer overflow in grub_parser_split_cmdline()

A flaw was found in grub2. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with...

Arbitrary Code Injection

Overview underscore is a JavaScript's functional programming helper library. Affected versions of this package are vulnerable to Arbitrary Code Injection via the template function, particularly when the variable option is taken from .templateSettings as it is not sanitized. PoC const =...