There is no way to withdraw the Fees from the reserve contract

Lines of code Vulnerability details Impact This will mean 1000 of dollars worth of ZCHF in fees cannot be withdrawn by the owner Proof of Concept The reserve contract currentlyor can be the frankencoin contract also lacks a function for withdrawing ZCHF tokens, which are deposited as fees when...

The minter can steal the Frankencoin in notifyLoss()

Lines of code Vulnerability details Impact The minter can steal the Frankencoin in notifyLoss because of In this code: if reserveLeft = amount transferaddressreserve, msg.sender, amount; The minter can call the function notifyLoss Constantly. When reserveLeft = amount, the minter who call the fir...

can open a position without any collateral in MintingHub.sol

Lines of code Vulnerability details Impact openPosition... function in MintingHub.sol ignores return value by challenge.position.collateral.transferFrom Several tokens do not revert in case of failure and return false. The require still pass but then, if the token used as collateral return false,...

ERC777 Re-entrancy Risk

Lines of code Vulnerability details Impact The code does not screen out for tokens that use the erc777 standard and therefore presents a re-entrancy risk via the token's callback function Proof of Concept Tools Used Manual Recommended Mitigation Steps Add in re-entrancy lock to function --- The...

CVE-2023-20862

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the...

CVE-2023-20862

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the...

createNewPosition/clonePosition/createClone are suspicious of the reorg attack

Lines of code Vulnerability details Description The createNewPosition function creates a new position smart contract and returns its address. The address is determined by create address derivation, that depends on the contract nonce. Later user could use interact with newly created contract. At t...

Equity.sol : restructureCapTable is not using correct index in array

Lines of code Vulnerability details Impact When array of addresses are passed to restructure in the emergency situation, contract would revert due to accessing the first index always. Not able to restructure in single call during emergency. Proof of Concept function restructureCapTableaddress...

Position.sol: usage of an incorrect version of Ownable library can potentially malfunction all onlyOwner functions

Lines of code Vulnerability details Impact // From https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/access/Ownable.sol The current implementaion is using a non-upgradeable version of the Ownable library isnstead of the upgradeable version:...

CVE-2023-29510

CVE-2023-29510 is a code injection/remote execution vulnerability in XWiki Platform caused by unescaped user-scoped translations that can be injected in privileged contexts. The issue allows remote code execution for users with edit access on at least one document (potentially their own profile)....

CVE-2023-30557 SQL injection in data_dictionary.py table_info method in Archery - GHSL-2022-106

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the datadictionary.py tableinfo. User input coming from the dbname in a...

CVE-2023-30556 SQL injection in sql_optimize.py optimize_sqltuningadvisor method in Archery - GHSL-2022-107

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the optimizesqltuningadvisor method of sqloptimize.py. User input comin...

CVE-2023-30555 SQL injection in sql_optimize.py explain method in Archery - GHSL-2022-108

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases.Affected versions are subject to SQL injection in the explain method in sqloptimize.py. User input coming from the dbname...

mitpflegeleben.de Cross Site Scripting vulnerability OBB-3266409

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets

Over the past several months, Microsoft has observed a mature subgroup of Mint Sandstorm, an Iranian nation-state actor previously tracked as PHOSPHORUS, refining its tactics, techniques, and procedures TTPs. Specifically, this subset has rapidly weaponized N-day vulnerabilities in common...

SUSE CVE-2023-1998

The Linux kernel allows userspace processes to enable mitigations by calling prctl with PRSETSPECULATIONCTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to...

HTTP Multiline Header Termination Vulnerability

The package laminas/laminas-diactoros Diactoros is a PSR-7 HTTP Message and PSR-17 HTTP Message Factory implementation, providing HTTP request and response message representations both for making HTTP client requests and responding to HTTP requests server-side. Affected versions of Diactoros...

CVE-2023-29199

A flaw was found in the vm2 sandbox. When exception handling is triggered, the sanitization logic is not managed with proper exception handling. This issue may allow an attacker to bypass the sandbox protections which can lead to remote code execution on the hypervisor host or the host which is...

CVE-2023-1998

It was found that the Linux Kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The kernel failed to protect applications that attempted to protect against Spectre v2 leaving them open to attack from other processes...

PT-2023-5864 · Autodesk · Autodesk Fbx-Sdk

Name of the Vulnerable Software and Affected Versions: Autodesk FBX SDK versions 2020 and prior Description: The issue is related to a stack buffer overflow vulnerability that can be exploited by opening a malicious FBX file, potentially leading to code execution. This vulnerability is associated...