CVE-2021-22567 Bidirectional Override in Dart SDK

Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible to a code reviewer that modifies the behavior of a progra...

CVE-2021-22567 Bidirectional Override in Dart SDK

Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible to a code reviewer that modifies the behavior of a progra...

Iterating over large count numbers can cause out of gas errors

Handle jayjonah8 Vulnerability details Impact In XDEFIDistributionHelper.sol the getAllTokensForAccount function iterates over the count and performs actions on each iteration. Iterating over large arrays can cause out of gas failures and so the count number should be checked or limited to a max...

DOS - preventing users from locking assets

Handle egjlmn1 Vulnerability details An attacker can prevent any user from locking assets due to the unsafe id generation for the nfts. The id is generated by using only the amount deposited, the duration to lock and the totalSiupply of nfts. The first two are easy for the attacker to copy, so al...

WordPress LabTools plugin <= 1.0 - Arbitrary Publication Deletion vulnerability

Arbitrary Publication Deletion vulnerability discovered by Muhammad Adel in WordPress LabTools plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of December 28, 2021 and is not available for download. This closure is temporary, pending a full review...

USDV.sol Mint and Burn Amounts Are Incorrect

Handle leastwood Vulnerability details Impact The USDV.mint function queries the price of Vader from the LiquidityBasedTwap contract. The calculation to determine uAmount in mint is actually performed incorrectly. uAmount = vPrice vAmount / 1e18; will return the USD amount for the provided Vader ...

TrojanSourceFinder - Help Find Trojan Source Vulnerability In Code

TrojanSourceFinder helps developers detect "Trojan Source" vulnerability in source code. Trojan Source vulnerability allows an attacker to make malicious code appear innocent. In general, the attacker tries to lure by passing his code off as a comment visually. It is a serious threat because it...

Unsafe transfers in NFTXFlashSwipe

Handle 0x1f8b Vulnerability details Impact Unsafe transfers. Proof of Concept In the methods NFTXFlashSwipe.flashSwipe and NFTXFlashSwipe.onFlashLoan there are some transfers, transferFroms and approve made without checking the boolean result, ERC20 standard specify that the token can return fals...

Oracle doesn't calculate USDV/VADER price correctly

Handle TomFrenchBlockchain Vulnerability details Impact Invalid values returned from oracle for USDV and VADER prices in situations where the oracle uses more than one foreign asset. Proof of Concept The USDV price is calculated as so for simplicity we'll consider a two pairs: totalUSD =...

CVE-2021-43439

RCE in Add Review Function in iResturant 1.0 Allows remote attacker to execute commands remotely...

CVE-2021-43439

RCE in Add Review Function in iResturant 1.0 Allows remote attacker to execute commands remotely...

Command injection

RCE in Add Review Function in iResturant 1.0 Allows remote attacker to execute commands remotely...

CVE-2021-43439

RCE in Add Review Function in iResturant 1.0 Allows remote attacker to execute commands remotely...

CVE-2021-43439

CVE-2021-43439 : RCE in the Add Review Function of iResturant 1.0 allows a remote attacker to execute commands. The NVD entry lists CVSSv3.1 base score 9.8 (CRITICAL) with network access, no user interaction, and high confidentiality/integrity/availability impact. Connected documents provide cont...

MartDevelopers iResturant 跨站脚本漏洞

MartDevelopers iResturant is an open source lightweight restaurant Erp from MartDevelopers Kenya, designed to integrate social restaurant operations into a single system. A cross-site scripting vulnerability exists in version 1.0 of MartDevelopers iRestaurant, which stems from a lack of filtering...

SafeERC20 Is Not Used On Token Transfers

Handle leastwood Vulnerability details Impact The transfer function is used on WETH and vault token transfers over OpenZeppelin's SafeERC20 library. As a result, these function may return unintended results which are not handled correctly. The SafeERC20 library ensures transfer and transferFrom...

_mint721() function can be broken because of strict equality check on token balance

Handle jayjonah8 Vulnerability details Impact In NFTXMarketplaceZap.sol the mint721 function has a require check that the balance must be equal to the amount of vault tokens in the contract. uint256 balance = count BASE - count INFTXVaultvault.mintFee; requirebalance ==...

Oracle WebLogic Detection and Mitigation

We review 2020 and 2021 Oracle WebLogic vulnerabilities and how using a unified SaaS platform can help you detect and mitigate these sophisticated risks...

sendAllocatedYETI() can be called by anyone

Handle jayjonah8 Vulnerability details Impact In TeamAllocation.sol, the sendAllocatedYETI function simply distributes YETI to the team. This is a transfer of value and it currently can be called by anyone as the onlyTeam modifier is not used here. Proof of Concept Tools Used Manual code review...

receiveCollateral() can be called by anyone

Handle jayjonah8 Vulnerability details Impact In StabilityPool.sol, the receiveCollateral function should be called by ActivePool per comments, but anyone can call it passing in tokens and amounts args to update stability pool balances. Proof of Concept Tools Used Manual code review Recommended...