3581 matches found
A previously timelocked NFT token becomes permanently stuck in vault if it’s ever moved back into the vault
Handle 0xRajeev Vulnerability details Impact Let’s consider a scenario where a particular NFT token was timelocked for a certain duration by the owner using timeLockERC721 with a delegate as the recipient and then transferred out of the vault by the delegate via transferERC721 but without unlocki...
Hypervisor.stake does not transfer tokens
Handle cmichel Vulnerability details Vulnerability Details The Hypervisor's stake action states: token transfer: transfer staking tokens from msg.sender to vault But no tokens are ever transferred. Impact Anyone with a permission can lock any amount of tokens. Recommended Mitigation Steps Transfe...
Unhandled return value of transferFrom in timeLockERC20() could lead to fund loss for recipients
Handle 0xRajeev Vulnerability details Impact ERC20 implementations are not always consistent. Some implementations of transfer and transferFrom could return ‘false’ on failure instead of reverting. It is safer to wrap such calls into require statements or use safe wrapper functions implementing...
Hypervisor.stake does not transfer tokens
Handle cmichel Vulnerability details Vulnerability Details The Hypervisor's stake action states: token transfer: transfer staking tokens from msg.sender to vault But no tokens are ever transferred. Impact Anyone with a permission can lock any amount of tokens. Recommended Mitigation Steps Transfe...
GHSA-25XJ-89G5-FM6H Information Disclosure in HashiCorp Vault
HashiCorp Vault and Vault Enterprise before 1.3.6, and 1.4.2 before 1.4.2, insert Sensitive Information into a Log File. The vulnerability is affecting github.com/hashicorp/vault/command Go package...
Information Disclosure in HashiCorp Vault
HashiCorp Vault and Vault Enterprise before 1.3.6, and 1.4.2 before 1.4.2, insert Sensitive Information into a Log File. The vulnerability is affecting github.com/hashicorp/vault/command Go package...
GHSA-75PC-QVWC-JF3G Improper Input Validation in HashiCorp Vault
HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control...
Improper Input Validation in HashiCorp Vault
HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control...
The vulnerability of the Database Vault component of the Oracle Database Server system allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Database Vault component of the Oracle Database Server database management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using the Oracle...
NFTXLPStaking Is Subject To A Flash Loan Attack That Can Steal Nearly All Rewards/Fees That Have Accrued For A Particular Vault
Handle jvaqa Vulnerability details NFTXLPStaking Is Subject To A Flash Loan Attack That Can Steal Nearly All Rewards/Fees That Have Accrued For A Particular Vault Impact The LPStaking contract does not require that a stake be locked for any period of time. The LPStaking contract also does not tra...
HashiCorp Vault Information Disclosure Vulnerability (CNVD-2021-37053)
HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. An information disclosure vulnerability exists in HashiCorp vault-action prior to version 2.2.0, which stems from a multi-line secret that fails to properly register with GitHub Actions to mask logs, which can b...
Information Disclosure
github.com/hashicorp/vault-action/ is vulnerable to information disclosure. Multi-line secrets are not properly masked in its output and can potentially result in credentials disclosure...
CVE-2021-32074
HashiCorp vault-action aka Vault GitHub Action before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking...
CVE-2021-32074
HashiCorp vault-action aka Vault GitHub Action before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking...
Denial of service
HashiCorp vault-action aka Vault GitHub Action before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking...
CVE-2021-32074
HashiCorp vault-action (Vault GitHub Action) prior to version 2.2.0 is affected. Affected component: vault-action, which fails to correctly register multi-line secrets for GitHub Actions log masking, enabling potential disclosure of sensitive information from logs. Remediation: upgrade to vault-a...
CVE-2021-32074
HashiCorp vault-action aka Vault GitHub Action before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking...
HashiCorp Vault 日志信息泄露漏洞
HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. An information disclosure vulnerability exists in HashiCorp vault-action prior to version 2.2.0, which stems from a multi-line secret that fails to properly register with GitHub Actions to mask logs, which can b...
Vault GitHub Action Did Not Correctly Mask Multi-Line Secrets In Output
Summary The Vault GitHub Action, vault-action or vault-secrets “vault-action”, did not correctly mask multi-line secrets in its output. This vulnerability, CVE-2021-32074, was fixed in vault-action 2.2.0. Background The Vault GitHub Action, vault-action...