[WP-H1] LenderPool.sol#terminate() Wrong value is used for the shares argument of SAVINGS_ACCOUNT.withdrawShares() can cause fund loss to all users

Lines of code Vulnerability details / @notice Function invoked when pooled credit line is terminated by admin @dev only pooledCreditLineContract can invoke @param id identifier for the pooled credit line @param to address to which all the borrow tokens are transfered / function terminateuint256 i...

Incorrect borrowLimit used in calculating principal to withdraw for non-activated pools that are terminated

Lines of code Vulnerability details Impact LenderPool does not check the status of CreditLine when admin calls terminate. Thus if a careless admin discovered some malicious borrower and accidentaly terminated the pool before it went active, excessive tokens will be withdrawn, resulting in stolen...

LenderPool.terminate mix calculation between shares and tokens, resulting in incorrect amount of shares to be withdrawn from savings account

Lines of code Vulnerability details Impact While calculating the amount of shares to withdraw in LenderPool.terminate, principalWithdrawable which is amount of tokens is added to totalInterestInShares, and then passed to SAVINGSACCOUNT.withdrawShares. If tokens : shares are not 1 : 1, which is th...

LenderPool: Principal withdrawable is incorrectly calculated if start() is invoked with non-zero start fee

Lines of code Vulnerability details Details & Impact The principalWithdrawable calculated will be more than expected if start is invoked with a non-zero start fee, because the borrow limit is reduced by the fee, resulting in totalSupplyid not being 1:1 with the borrow limit. function...

First user can prevent later users receiving collateral shares

Lines of code Vulnerability details Impact All users after the first the attacker will receive no collateral shares in return for their deposit, losing their tokens. Proof of Concept On the first mint of Collateral tokens the amount to be minted is equal to the amount of tokens deposited, on late...

CVE-2022-26778

Veritas System Recovery VSR 18 and 21 stores a network destination password in the Windows registry during configuration of the backup configuration. This could allow a Windows user who has sufficient privileges to access a network file system that they were not authorized to access...

Veritas System Recovery安全漏洞

Veritas System Recovery is a system recovery software from Veritas, USA. The software provides Windows systems with the ability to recover a corrupted system without reinstalling the system. A security vulnerability exists in Veritas System Recovery VSR 18 and 21, which originates from storing...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

first depositor of the insurance fund can drain the other depositors

Lines of code Vulnerability details in deposit, when the ratio totalSupply / balance is very high, the amount of the minted shares can round down to zero. Proof of Concept Alice is the first one to deposit to the insurance fund. she deposits 1 basic unit of vusd 10-6 dollar, therefore minting one...

ERC4626.mint() doesn't mint the correct amount

Lines of code Vulnerability details Impact The ERC4626.mint function doesn't mint the correct amount of tokens. Instead of minting amount number of tokens, it should mint shares number of tokens. Since the user doesn't receive the correct amount of tokens I'd rate this issue "HIGH". Proof of...

CVE-2021-44141

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succee...

AZL-37007 CVE-2021-44141 affecting package samba for versions less than 4.18.3-1

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succee...

ALPINE-CVE-2021-44141

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succee...

Security Bulletin: IBM Aspera Shares 1.9.14 Patch Level 1 and earlier are vulnerable to DOM XSS

Summary DOM XSS on IBM Aspera Shares 1.9.14 Patch Level 1 and earlier could lead to HTML/JS injection and Account takeover. Vulnerability Details CVEID: CVE-2020-4731 DESCRIPTION: IBM Aspera Web Application is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary...

ERC4626RouterBase.withdraw should use a **max** shares out check

Lines of code Vulnerability details Impact The docs/video say ERC4626RouterBase.sol is in scope as its part of TurboRouter The ERC4626RouterBase.withdraw function withdraws the asset amount parameter by burning shares. function withdraw IERC4626 vault, address to, uint256 amount, uint256...

Snaffler - A Tool For Pentesters To Help Find Delicious Candy

Snaffler is a tool for pentesters to help find delicious candy needles creds mostly, but it's flexible in a bunch of horrible boring haystacks a massive Windows/AD environment. It might also be useful for other people doing other stuff, but it is explicitly NOT meant to be an "audit" tool. I don'...

ThecosomataETH.addLiquidity can be subject to sandwich attack

Lines of code Vulnerability details Impact Liquidity addition can happen at a manipulated pool state and result in receiving fewer LP shares than actual market state dictates Proof of Concept addLiquidity measures slippage based on the pool returned amount via calctokenamount: Pool returned amoun...

Debian DLA-2918-1 : debian-edu-config - LTS security update

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2918 advisory. Marcel Neumann, Robert Altschaffel, Loris Guba and Dustin Hermann discovered that debian-edu-config, a set of configuration files used for the Debian Edu blend configured...

CVE-2021-20001

It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the user web shares /publichtml, which could result in privilege escalation...

CVE-2021-20001

It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the user web shares /publichtml, which could result in privilege escalation...