There is no way to retrieve the rewards from the MultisigManager and rewards are locked in the vault.

Lines of code Vulnerability details C4 issue M-21: Division by zero error can block RewardsPoolstartRewardCycle if all multisig wallet are disabled. Comments The protocol provides an external function startRewardsCycle so that anyone can start a new reward cycle if necessary. Before mitigation,...

Vault, Consul, Boundary, and Waypoint Affected By Denial of Service in Go’s net/http (CVE-2022-41717)

Summary A denial of service vulnerability was reported in Golang’s net/http package. This vulnerability, CVE-2022-41717, was fixed in conjunction with another security issue in Go releases 1.18.9 and 1.19.4, and subsequently addressed with new releases of the affected HashiCorp products listed...

ERC4626 vault shares can be maliciously inflated

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The price of ERC4626 vault shares can be maliciously inflated during the first deposit, leading to the loss of assets for next depositors Proof of Concept Provide direct links to all referenced code in...

ABI mismatch when calling initialize function

Lines of code Vulnerability details Impact This is the initialize function of contract Vault. It has 5 parameters. function initialize IERC20 asset, IERC4626 adapter, VaultFees calldata fees, address feeRecipient, address owner external initializer But when calling this function in VaultControlle...

CVE-2020-12757

A flaw was found in the HashiCorp Vault. The HashiCorp Vault and Vault Enterprise could allow a remote attacker to bypass security restrictions caused by incorrect access control in the secrets/gcp. By sending a specially crafted request, an attacker can bypass access restrictions...

CVE-2020-13223

A flaw was found in the HashiCorp Vault. The HashiCorp Vault and Vault Enterprise could allow a remote attacker to obtain sensitive information caused by inserting sensitive information into a log file. By accessing the log file, a remote attacker can obtain sensitive information...

CVE-2020-16250

A flaw was found in Vault and Vault Enterprise “Vault”. In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM identities and roles may be manipulated and bypass authentication...

CVE-2020-16251

A flaw was found in Vault and Vault Enterprise “Vault”. In affected versions of Vault, with the GCP Auth Method configured and under certain circumstances, the values relied upon by Vault to validate Google Compute Engine GCE VMs may be manipulated and bypass authentication...

CVE-2021-43998

A flaw was found in HashiCorp Vault. In affected versions of HashiCorp Vault and Vault Enterprise, templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy...

WordPress IP Vault – WP Firewall Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software IP Vault – WP Firewall Type Plugin Vulnerable versions = 1.1 Fixed in 2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47171 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 98996a8ae2cc Credits rezaduty Required...

IP Vault - WP Firewall <= 1.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Malicious code in rasp-vault (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 617da77b8370755ce77e45af7493864f59db88899f6d19414de75f18b2b166d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-720 Malicious code in rasp-vault (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 617da77b8370755ce77e45af7493864f59db88899f6d19414de75f18b2b166d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-989 Malicious code in yandex-passport-vault-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5ec06c5f507c87c261fef04893899d0656796eae3510e71635067b7912f25c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yandex-passport-vault-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5ec06c5f507c87c261fef04893899d0656796eae3510e71635067b7912f25c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview yandex-passport-vault-client is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

Malicious Package

Overview rasp-vault is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Attacker can steal the NFT bought by sending it to another vault he control

Lines of code Vulnerability details Impact The mitigation of H-08 try to validate the vault returned by market with the VaultRegistry. However, it only validated if the vault exists, but not if it is the correct vault. A similar attack described in code-423n4/2022-12-tessera-findings47 can be...

ipa bug fix and enhancement update

An update is available for ipa. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Rocky Enterprise Software Foundation Identity Management IdM is a centralized...

Upgraded Q -> M from #351 [1674418158719]

Judge has assessed an item in Issue 351 as M risk. The relevant finding follows: Stable Vault cannot accept tokens with more then 18 decimals because of this lines: Consider using different conversion formula. For example: amount 1e18 / 10token.decimals for deposit and amount 10token.decimals /...