Upgraded Q -> 2 from #19 [1677669238372]

Judge has assessed an item in Issue 19 as 2 risk. The relevant finding follows: KUMABondToken.sol KBT-01L: Potential Approval Blacklist Bypass Affected Lines: L148 The KUMABondToken::approve function will apply a blacklist check on the to as well as msg.sender contextual arguments of the call,...

Upgraded Q -> 2 from #795 [1677634099280]

Judge has assessed an item in Issue 795 as 2 risk. The relevant finding follows: 04 VALUES OF fees ARE NOT CHECKED IN Vault.initialize FUNCTION When calling the following Vault.initialize function, the values of fees are not checked. It is possible that these fees are set to be above 1e18 when...

Upgraded Q -> 2 from #18 [1677668571999]

Judge has assessed an item in Issue 18 as 2 risk. The relevant finding follows: L-01 changePayees can result in broken share count Description for uint256 i; i newPayees.length; i++ if newPayeesi == address0 revert Errors.CANNOTSETTOADDRESSZERO; if newSharesi == 0 revert Errors.SHARECANNOTBEZERO;...

Upgraded Q -> 2 from #19 [1677669261110]

Judge has assessed an item in Issue 19 as 2 risk. The relevant finding follows: KFC-03L: Inexistent Duplicate Entry Prevention Affected Lines: L175-L180 The KUMAFeeCollector::changePayees function does not adequately sanitize the new payees, permitting duplicate entries to exist which will cause...

Upgraded Q -> 2 from #625 [1677633526031]

Judge has assessed an item in Issue 625 as 2 risk. The relevant finding follows: 4. lastHarvest variable inside AdapterBase will never be updated after a successful harvest,this will create big problems related to all the harvest function inside AdapterBase by making this function unusable,in fac...

Upgraded Q -> 2 from #7 [1677668529704]

Judge has assessed an item in Issue 7 as 2 risk. The relevant finding follows: L-01 changePayees Suggest adding to check whether newPayees are duplicated to avoid totalShares error function changePayeesaddress calldata newPayees, uint256 calldata newShares external override onlyManager ... for...

Hitachi Energy Relion 670, 650 and SAM600-IO Series

1. EXECUTIVE SUMMARY CVSS v3 4.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Relion 670, 650, and SAM600-IO Series Vulnerability: Insufficient Verification of Data Authenticity 2. RISK EVALUATION Successful exploitation of this vulnerability could cause...

Upgraded Q -> 2 from #523 [1677626174331]

Judge has assessed an item in Issue 523 as 2 risk. The relevant finding follows: Title Add function for feeRecipient change in MultiRewardEscrow.sol contract Links to affected code Vulnerability details Impact If account feeRecipient would be compromised, or the protocol owner wants from some oth...

Upgraded Q -> 2 from #823 [1677594201547]

Judge has assessed an item in Issue 823 as 2 risk. The relevant finding follows: L-01 Low level call result not correctly checked The last adminProxy.execute is not checked for success. function deployAdapter DeploymentArgs memory adapterData, bytes memory baseAdapterData, IDeploymentController...

Exploit for Command Injection in Contec Solarview_Compact_Firmware

CVE-2022-40881 fofa body="SolarView Compact" && title=="T...

Upgraded Q -> 2 from #596 [1677228840417]

Judge has assessed an item in Issue 596 as 2 risk. The relevant finding follows: withdraw and redeem function withdraw IERC4626 vault, address to, uint256 amount, uint256 maxSharesOut public payable virtual override returns uint256 sharesOut ERC20addressvault.safeApproveaddressvault, amount; if...

Debian: Security Advisory (DSA-5358-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Upgraded Q -> 3 from #148 [1677186744098]

Judge has assessed an item in Issue 148 as 3 risk. The relevant finding follows: Lines of code Vulnerability details Impact Detailed description of the impact of this finding. buyoutLien in LienToken.sol failes to update the new PublicVault's slope, yIntercept, and s.epochData....liensOpenForEpoc...

3 Steps to Automate Your Third-Party Risk Management Program

If you Google "third-party data breaches" you will find many recent reports of data breaches that were either caused by an attack at a third party or sensitive information stored at a third-party location was exposed. Third-party data breaches don't discriminate by industry because almost every...

K2104: Buffer read overflow in DNS resolver libraries - CAN-2002-1146

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...

Upgraded Q -> 3 from #71 [1676966386580]

Judge has assessed an item in Issue 71 as 3 risk. The relevant finding follows: L-04 onlyMinter modifier is not working as expected Description onlyMinter can be bypasssed by anyone due to an invalid check: modifier onlyMinter msg.sender == minterAddress; ; Thus, everyone can mint tokens: functio...

PT-2023-14728 · Unknown · Tanujpatra228 Tution Management System

Name of the Vulnerable Software and Affected Versions: tanujpatra228 Tution Management System TMS affected versions not specified Description: The issue is related to a SQL Injection Vulnerability in the tanujpatra228 Tution Management System TMS via the email parameter to the "processes/student...

Weintek EasyBuilder Pro cMT Series

1. EXECUTIVE SUMMARY CVSS v3 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Weintek Equipment: EasyBuilder Pro Vulnerability: Path Traversal: '\..\filename' 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain control of the user’s...

IDC MarketScape Names Akamai a Contender in Worldwide Public Cloud IaaS

Akamai’s inclusion as a Contender in the "IDC MarketScape: Worldwide Public Cloud Infrastructure as a Service Vendor Assessment" demonstrates the strength of our cloud computing services...

Upgraded Q -> 2 from #206 [1676531414343]

Judge has assessed an item in Issue 206 as 2 risk. The relevant finding follows: Issue 2: receipts are not burned upon claiming reward. In my opinion, current system of just claiming some tokens to be "used" has some downsides: in any claim check, users spend gas to iterate over these tokens too...