64 matches found
Upgraded Q -> H from 104 [1656255316696]
Judge has assessed an item in Issue 104 as High risk. The relevant finding follows: L02: Incompatibility with ERC-4626 Line References Description The EIP-4626 specification requires that totalAssets to NOT revert, but the current implementation does so in the underlying methods: int256...
Upgraded Q -> H from 222 [1656255302682]
Judge has assessed an item in Issue 222 as High risk. The relevant finding follows: L-02 totalAssets of erc4626 should never revert eip-4626 According to the spec, totalAssets of erc4626 should never revert MUST NOT revert. wfcash would revert if it's matured but hasn't settled...
Rounding Issues In Certain Functions
Lines of code Vulnerability details Background Per EIP 4626's Security Considerations Finally, ERC-4626 Vault implementers should be aware of the need for specific, opposing rounding directions across the different mutable and view methods, as it is considered most secure to favor the Vault itsel...
Deposit of wrappedFCash does not follow EIP 4626
Lines of code Vulnerability details Impact The deposit of wfCashERC4626 is not 4626 compatible. wfCashERC4626.solL168-L175 According to EIP4626 MUST revert if all of assets cannot be deposited due to deposit limit being reached, slippage, the user not approving enough underlying tokens to the Vau...
StakedCitadel should implement EIP-4626
Lines of code Vulnerability details StakedCitadel should implement EIP-4626 StakedCitadel could be seen as an investment vault and therefore team should consider implementing the recent EIP-4626 standard, as it could enable a lot of potential integrations and would avoid having to deploy wrappers...
TurboSafe - should override maxWithdraw and maxRedeem
Lines of code Vulnerability details Impact Considering the EIP , as withdraw must revert if it is not possible to withdraw assets , it is important to have an accurate maxWithdraw function. However, here, maxWithdraw does not account for the current max withdrawal in the cToken contract. Liquidit...
IERC4626RouterBase - withdraw - slippage does not work
Lines of code Vulnerability details Impact The router does not have the intended behavior: according to the EIP , withdraw burn shares to withdraw exactly assets, so the slippage protection should protect the user from burning too many shares. Furthermore, comments in the interface are incorrect ...
RHEL 8 : RHV Manager (ovirt-engine) security update [ovirt-4.4.9] (Moderate) (RHSA-2021:4626)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4626 advisory. The ovirt-engine package provides the manager for virtualization environments. This manager enables admins to define hosts and networks, as...
CVE-2020-4626
IBM Cloud Pak for Security 1.3.0.1 CP4S could reveal sensitive information about the internal network to an authenticated user using a specially crafted HTTP request. IBM X-Force ID: 185362...
CVE-2020-4626
CVE-2020-4626 affects IBM Cloud Pak for Security (CP4S) 1.3.0.1. An authenticated user can cause information disclosure by sending a specially crafted HTTP request, potentially revealing sensitive internal network information. The IBM security bulletin notes the issue and provides a remediation p...
Security Bulletin: IBM Cloud Pak for Security (CP4S) could reveal sensitive information to authenticated user (CVE-2020-4626)
Summary IBM Cloud Pak for Security CP4S could reveal sensitive information about the internal network to an authenticated user using a specially crafted HTTP request. The issue has been addressed. Vulnerability Details CVEID: CVE-2020-4626 DESCRIPTION: IBM Cloud Pak for Security CP4S could reveal...
Ubuntu: Security Advisory (USN-4626-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian: Security Advisory (DSA-4626-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-4626-1 : php7.3 - security update
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in information disclosure, denial of service or incorrect validation of path names. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...
CVE-2011-4626
Cross-site Scripting XSS in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the "JSwindow" property of the typolink function...
CVE-2011-4626
TYPO3 CVE-2011-4626 is a cross-site scripting (XSS) vulnerability in TYPO3 core prior to 4.3.12, 4.4.x prior to 4.4.9, and 4.5.x prior to 4.5.4. It allows remote attackers to inject arbitrary web script or HTML via the JSwindow property of the typolink function. Reports in connected documents con...
CVE-2017-4626
CVE-2017-4626 is rejected/not used; this entry does not represent an active vulnerability.
About the security content of tvOS 9.2.2 - Apple Support
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...
CVE-2015-4626
CVE-2015-4626 affects B.A.S C2Box; versions before 4.0.0 (r19171) rely on client-side validation, enabling a remote attacker to bypass validation and corrupt business logic via negative overdraft input. The vulnerability stems from unvalidated client input allowing server-side impact. >=4.0.0 ...