Staking.setCurvePool() doesn't approve allowance when changes CURVE_POOL.

Lines of code Vulnerability details Impact Staking.setCurvePool doesn't approve allowance when changes CURVEPOOL. It will affect when users exchange asset through CURVEPOOL. Proof of Concept When initialize the contract, Staking contract approves CURVEPOOL here. But when admin updates CURVEPOOL...

NibblVault permit functionality allows redeeming only one "active" signature

Lines of code Vulnerability details Impact Contract NibblVault implements function permit that allows approving spender to spend value of tokens that belongs to owner. The issue is that structHash keeps incrementing noncesowner++ which in case of multiple "active" permits signatures of the same...

ERC721 support not checked - NFT loss

Lines of code Vulnerability details Impact It is not checked whether withdrawn token supports ERC721 interface. Also there is no check to see if necessary approval have been set for sending nft The fix need to be applied for all other functions withdrawing ERC721 Proof of Concept 1. Observe the...

WETH#approve can be used to steal user balances

Lines of code Vulnerability details Impact In WETH.sol 2nd approve function can be used to update allowance of any user, it can be used to steal users balance Proof of Concept function approveaddress owner, address spender external returnsbool approveowner, spender, balanceOfowner; return true;...

Malicious code in restaurant-approval (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware adb3e450eebc78ce5cfa2d220bbcf765c204e59a33ec2360277e495d0b1303e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5767 Malicious code in restaurant-approval (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware adb3e450eebc78ce5cfa2d220bbcf765c204e59a33ec2360277e495d0b1303e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Did Not Approve To Zero First Causing Certain Token Transfer To Fail

Lines of code Vulnerability details Proof-of-Concept Some tokens like USDT do not work when changing the allowance from an existing non-zero allowance value. For example Tether USDT's approve function will revert if the current approval is not zero, to protect against front-running changes of...

AssetLogic's _swapAssetOut can fail on the one step approval

Lines of code Vulnerability details swapAssetOut performs one step approval for an arbitrary assetIn before calling pool's swapExactOut. As ERC20 that do not allow approval race condition prohibit setting approval to a new positive value when allowance is positive already, this call will fail if...

Approve Returned Value Not Validated

Lines of code Vulnerability details Proof-of-Concept The approve function attempts to performs an ERC20.approve call, but does not check if the returned value is true Succeed or false Failed. Some tokens do not revert if the approval failed but return false instead. / @dev Approve the given...

NotionalTradeModule._approve() function is missing return value check.

Lines of code Vulnerability details Impact NotionalTradeModule.mintFCashPosition wouldn't work properly when approve function fails to approve without reverting. Proof of Concept This approve function performs an ERC20.approve call but does not check the success return value. Some tokens do not...

CVE-2022-25152

The ITarian platform SAAS / on-premise offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor with a...

CVE-2022-25152

The ITarian platform SAAS / on-premise offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor with a...

Design/Logic Flaw

The ITarian platform SAAS / on-premise offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor with a...

The vulnerability of the AME Page rendering component of the Oracle Approvals Management component within the Oracle E-Business Suite system, which allows a perpetrator to gain access to read, modify, add, or delete data.

The vulnerability in the AME Page rendering of the Oracle Approvals Management component of the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to gain access to read, modify, add, or delete data through HTTP...

ITarian Saas platform 安全漏洞

ITarian is a remote access and IT management solution from ITarian, Inc. that helps organizations connect and communicate with their customers and employees, facilitating remote file access, system monitoring, troubleshooting and operations management across teams. A security vulnerability exists...

CVE-2022-25152 ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals

The ITarian platform SAAS / on-premise offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor with a...

CVE-2022-25152 ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals

The ITarian platform SAAS / on-premise offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor with a...

Discourse 2.9.x < 2.9.0.beta5 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

Discourse < 2.8.4 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

CVE-2022-25152

The CVE-2022-25152 entry concerns ITarian’s platform (SaaS and on-premise) where a flaw in the agent-Run code workflow (procedures) allows bypassing the mandatory approval process. Versions before 6.35.37347.20040 are affected; a user with a valid session token can create a procedure, bypass appr...