Mitigation of M-05: Issue not mitigated

Lines of code Vulnerability details The sponsor disputes the issue, but never follows up after judge's comments, so the same issue remains in the new code. --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of M-02: Issue not mitigated

Lines of code Vulnerability details Mitigation of M-02: Issue not mitigated --- The text was updated successfully, but these errors were encountered: All reactions...

PT-2023-15549

Name of the Vulnerable Software and Affected Versions Opencats version 0.9.7 Description A reflected cross-site scripting XSS issue was found in Opencats via the component "/opencats/index.php?m=settings&a=ajax tags upd". This allows for potential XSS attacks. Recommendations For Opencats version...

CVE-2022-48012

Opencats v0.9.7 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /opencats/index.php?m=settings&a=ajaxtagsupd...

CVE-2022-48013

Opencats v0.9.7 was discovered to contain a stored cross-site scripting XSS vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title text fields...

Upgraded Q -> M from #269 [1674743821419]

Judge has assessed an item in Issue 269 as M risk. The relevant finding follows: 269 --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> M from #598 [1674741121008]

Judge has assessed an item in Issue 598 as M risk. The relevant finding follows: Low: 1.deposit check wrong variant function deposituint256 assets, address receiver public virtual returns uint256 shares requireshares minDepositAmount, "VALUETOOSMALL"; requireassets minDepositAmount,...

Upgraded Q -> M from #598 [1674741102558]

Judge has assessed an item in Issue 598 as M risk. The relevant finding follows: 2.minDepositAmount When the asset is btc, the minDepositAmount is too large when asset == btc , minDepositAmount = 0.1 btc , equal 2000 usd suggest: function minDepositAmount public view virtual overrideERC4626Cloned...

Upgraded Q -> M from #55 [1674745091248]

Judge has assessed an item in Issue 55 as M risk. The relevant finding follows: minimum deposit amount for tokens with non standart decimals value are too high. 0.1 can be quite a lot for tokens with small totalAmount, so this requirement can become too restrictive. For example, WBTC token have 8...

Upgraded Q -> M from #404 [1674736594739]

Judge has assessed an item in Issue 404 as M risk. The relevant finding follows: L‑04 latestAnswer is deprecated Use latestRoundData instead so that you can tell whether the answer is stale or not. The latestAnswer function returns zero if it is unable to fetch data, which may be the case if...

Upgraded Q -> M from #229 [1674661320954]

Judge has assessed an item in Issue 229 as M risk. The relevant finding follows: Centralization Risk Contract: Impact: It seems the poolAdmin holds too much power including changing reward controller, rescue tokens etc. This can allow poolAdmin to impact all users by changing the config or draini...

Upgraded Q -> M from #374 [1674664049404]

Judge has assessed an item in Issue 374 as M risk. The relevant finding follows: L-03 WETHGateway.repayETH will revert if msg.value paybackAmount In the repayETH function, paybackAmount eth will be deposit to WETH contract to get paybackAmount weth back. WETH.depositvalue: paybackAmount; And then...

sleuthkit fls 操作系统命令注入漏洞

sleuthkit fls is a collection of data forensics tools from Brian Carrier's personal developer. An operating system command injection vulnerability exists in sleuthkit fls version 4.11.1, which stems from the presence of an operating system command injection vulnerability that allows an attacker t...

CVE-2022-45639

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user...

CVE-2022-45639: Improper Neutralization of Special Elements used in an OS Command

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user...

PT-2023-14727 · Sleuth Kit · Sleuthkit

Name of the Vulnerable Software and Affected Versions: sleuthkit fls tool version 4.11.1 Description: The issue allows attackers to execute arbitrary commands via a crafted value to the m parameter. This is an OS Command injection vulnerability. Note that there is a dispute regarding the impact o...

Upgraded Q -> M from #50 [1674461707004]

Judge has assessed an item in Issue 50 as M risk. The relevant finding follows: QA10. The deposit function only works for tokens that have no more than 18 decimals. This needs to be documented. --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> M from #445 [1674423223201]

Judge has assessed an item in Issue 445 as M risk. The relevant finding follows: 5 Function crossChain in GovNFT should have limit for maximum tokens allowed to be transferred, because of gas limit in the dest chain. if a user transferred a lot of tokens because there was two loop inside each oth...

Upgraded Q -> M from #97 [1674422838137]

Judge has assessed an item in Issue 97 as M risk. The relevant finding follows: DOS StableVault deposit and withdraws if ERC20 with more than 18 decimals used. Description withdraw and deposit functions in StableVault will revert if ERC20 token with more than 18 decimals is used. This is due to a...

Upgraded Q -> M from #658 [1674423084300]

Judge has assessed an item in Issue 658 as M risk. The relevant finding follows: L-04 USDT IS NOT SUPPORTED FOR CALLING Trading.handleDeposit FUNCTION ON ETHEREUM MAINNET As shown by , USDT on the Ethereum mainnet does not allow approving a new amount when the existing approved amount is not zero...