_reimburse() bypasses 1155 accounting, allowing potential fund drainage.

Lines of code Vulnerability details Impact The reimburse function allows the caller to withdraw any remaining source delegate balance back to themselves. This bypasses the 1155 token balances and could let the caller drain funds. For example: The reimburse function allows the caller to withdraw a...

[SECURITY] Fedora 39 Update: tacacs-F4.0.4.28.7fb~20231005g4fdf178-1.fc39

Tacacs+ tacplus is a C daemon that authenticates requests via the Tacacs+ Protocol and logs accounting information. This is a fork of Cisco + Shruberry's Tacacs+ daemons http://www.shrubbery.net/tacplus/...

The vulnerability of the Authentication, Authorization, and Accounting (AAA) function, as well as the SCP function of Cisco IOS and Cisco IOS XE operating systems, allows attackers to circumvent security restrictions and obtain or modify the configuration of vulnerable devices.

The vulnerability of the Authentication, Authorization, and Accounting AAA function and the SCP function of Cisco IOS and Cisco IOS XE operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions and obta...

[SECURITY] Fedora 38 Update: tacacs-F4.0.4.28.7fb~20231005g4fdf178-1.fc38

Tacacs+ tacplus is a C daemon that authenticates requests via the Tacacs+ Protocol and logs accounting information. This is a fork of Cisco + Shruberry's Tacacs+ daemons http://www.shrubbery.net/tacplus/...

[SECURITY] Fedora 37 Update: tacacs-F4.0.4.28.7fb~20231005g4fdf178-1.fc37

Tacacs+ tacplus is a C daemon that authenticates requests via the Tacacs+ Protocol and logs accounting information. This is a fork of Cisco + Shruberry's Tacacs+ daemons http://www.shrubbery.net/tacplus/...

Limit accrueConcentratedPositionTimeWeightedLiquidity calls to prevent reward manipulation.

Lines of code Vulnerability details Impact It may be possible for a user to artificially increase their tracked liquidity right before claiming by rapidly entering/exiting positions. This could allow them to claim a larger % of rewards than they deserve. Proof of Concept The main risk of...

USAGE OF abi.encodePacked TO ENCODE DATA COULD LEAD TO payload DATA COLLISION IN THE RootBridgeAgent._createSettlementMultiple FUNCTION

Lines of code Vulnerability details Impact The RootBridgeAgent.callOutAndBridgeMultiple function is used to settle multiple assets and perform a remote call to a branch chain. callOutAndBridgeMultiple function calls the RootBridgeAgent.createSettlementMultiple internal function to compute the...

Time-weighted liquidity accounting assumes consecutive activity; double counting possible, needs validation.

Lines of code Vulnerability details Impact Time-weighted liquidity accounting in accrueConcentratedPositionTimeWeightedLiquidity and similar functions assumes ticks were active consecutively between entry/exit timestamps. However, a tick could exit and re-enter in the same week, leading to double...

users can make multiple deposits through the same deposit nonce in branch bridge agent

Lines of code Vulnerability details Impact When a user retries the deposit there is a check that the deposit owner should be msg.sender but there is no check that the deposit failed so user can even retry successful deposits with the same nonce which can affect accounting badly Proof of Concept...

[SECURITY] Fedora 37 Update: slurm-22.05.9-5.fc37

Slurm is an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for Linux clusters. Components include machine status, partition management, job management, scheduling and accounting modules...

Cisco Adaptive Security Appliance Software Remote Access VPN Unauthorized Access - Brute Force Attack (cisco-sa-asaftd-ravpn-auth-8LyfCkeC)

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations. This vulnerability is due to improper separation o...

CVE-2023-20186

A vulnerability in the Authentication, Authorization, and Accounting AAA feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to bypass command authorization and copy files to or from the file system of an affected device using the Secure Copy...

CVE-2023-20186

A vulnerability in the Authentication, Authorization, and Accounting AAA feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to bypass command authorization and copy files to or from the file system of an affected device using the Secure Copy...

CVE-2023-20186

A vulnerability in the Authentication, Authorization, and Accounting AAA feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to bypass command authorization and copy files to or from the file system of an affected device using the Secure Copy...

CVE-2023-20186

Cisco IOS/IOS XE has a vulnerability in the AAA features that can allow an authenticated attacker with level 15 privileges to bypass command authorization and use SCP to copy files to or from the device. The root cause is incorrect SCP command processing within AAA authorization checks, enabling ...

Cisco IOS and IOS XE Software Command Authorization Bypass Vulnerability

A vulnerability in the Authentication, Authorization, and Accounting AAA feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to bypass command authorization and copy files to or from the file system of an affected device using the Secure Copy...

Incorrect AfEth.price() calculation

Lines of code Vulnerability details Impact AfEth.price may be calculated as too low. Proof of Concept AfEth.requestWithdraw does not burn the afEth but only transfers it to itself. Hence the withdrawRatio is calculated using only the free supply of afEth: AfEth.solL180-L185 // ratio of afEth bein...

MAL-2023-8241 Malicious code in accounting-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a22d55ca3dd67efe723d098fd88933dec7b4891b055c61248df097dfe348b736 The OpenSSF Package Analysis project identified 'accounting-core' @ 2.1.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in accounting-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a22d55ca3dd67efe723d098fd88933dec7b4891b055c61248df097dfe348b736 The OpenSSF Package Analysis project identified 'accounting-core' @ 2.1.0 npm as malicious. It is considered malicious because: - The package...

Fee on Transfer tokens cause incorrect accounting

Lines of code Vulnerability details Impact Incorrect accounting for fee on transfer tokens Proof of Concept Delegate accepts all ERC20 token types as specified by the contest page. Some ERC20 tokens include a fee on transfer which means means that the amount of tokens sent to the contract will be...