A single host can approve a proposal for all other hosts in the Party

Lines of code Vulnerability details Summary A single host can approve a proposal by transferring the host role to dummy accounts and voting again to increment the number of approvals. Impact When a proposal is created in a Party, the number of active hosts is snapshotted in the proposal state...

CVE-2023-4379

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated...

CVE-2023-4379

GitLab Enterprise Edition vulnerability CVE-2023-4379: Code owner approval was not removed from merge requests when the target branch was updated. Affected GitLab EE versions are 15.3–16.2.8, 16.3–16.3.5, and 16.4–16.4.1. Consequence is improper merge request handling potentially enabling unautho...

CVE-2023-4379 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated...

CVE-2023-4379

Removed by vendor...

Gitlab -- Vulnerabilities

Gitlab reports: Disclosure of CI/CD variables using Custom project templates GitLab omnibus DoS crash via OOM with CI Catalogs Parsing gitlab-ci.yml with large string via timeout input leads to Denial of Service DoS - Blocking FIFO files in Tar archives Titles exposed by service-desk template...

Compromised minter can change route to misdirect user funds

Lines of code Vulnerability details Impact The current security assumption revolves around the compromise of a minter, wherein they mint 200k USDe tokens for themselves and subsequently redeem them within the contract. Under this assumption, as long as the gatekeeper key remains secure, the minte...

Infodrom Software E-Invoice Approval System Security Breach

Infodrom Software E-Invoice Approval System is an electronic invoice approval system from Infodrom Software, Turkey. A security vulnerability exists in Infodrom Software E-Invoice Approval System version 2.1 that stems from improper protection of outbound error messages and alert signals...

ERC20ProxyDelegator contract will always lead to zero approval

Lines of code Vulnerability details Impact In constructor of ERC20ProxyDelegator contract token.approve have typeuint256.max. This leads to approval remain zero as nothing will happens due to wrong value provided. The main reason is due to the max approval attainable is typeuint256.max – 1. This...

_reimburse and createProxyDelegatorAndTransfer uses ERC20Votes.transferFrom with user as msg.sender, but allowance is given for ERC20MultiDelegate contract.

Lines of code Vulnerability details Description The delegateMulti external method is called by user. This function call some internal functions like reimburse and transferBetweenDelegators, which doesn't change the msg.sender because they are internal. So, when these functions try to use...

Approval Verification

Lines of code Vulnerability details Impact There is a great need for approval check before commencement of token transfer and clearing of excess approvals after token transfer has been done, to prevent potential third-party exploitation that could drain funds from unsuspecting users via the...

Unbounded approval in ERC20ProxyDelegator allows potential token theft; limit approvals.

Lines of code Vulnerability details Impact The proxy contract ERC20ProxyDelegator approves maximum possible tokens to the ERC20MultiDelegate contract. This could allow the ERC20MultiDelegate to steal all tokens from the proxy contracts. The approval amount should be limited to only what is...

USDT tokens should approve to zero first otherwise it may cause other tokens to get stuck in the case of aprooveMultipleTokens

Lines of code Vulnerability details Impact Unsafe ERC20 approve that do not handle non-standard erc20 behavior. Some token contracts do not return any value. Some token contracts revert the transaction when the allowance is not zero. Proof of Concept When receiving tokens to the destination chain...

FreeBSD : Gitlab -- vulnerabilities (6e0ebb4a-5e75-11ee-a365-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6e0ebb4a-5e75-11ee-a365-001b217b3468 advisory. - An information disclosure issue in GitLab CE/EE affecting all versions prior to 16.2.8, 16.3...

PT-2023-5678 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 15.3 through 16.2.7 GitLab EE versions 16.3 through 16.3.4 GitLab EE versions 16.4 through 16.4.0 Description: An issue has been discovered in GitLab EE related to insufficient access control. The issue allows a remote...

Swap functionality to sell rewards is too permissive and could cause accidental or intentional loss of value

Lines of code Vulnerability details Summary While the intention is to use the 0x protocol to sell rewards, the implementation doesn't provide any basic guarantee this will correctly happen and grants the rewarder arbitrary control over the tokens held by the strategy. Impact Rewards earned in the...

Incorrent approval for escrow tokens, not allowing to burn on redeem

Lines of code Vulnerability details Impact Liquidity pool approval for burning escrow tokens is not correctly assigned when pool is deployed on PoolManager deployLiquidityPool lines: EscrowLikeescrow.approveliquidityPool, addressinvestmentManager, typeuint256.max; // Approve investment manager on...

SafeTransferLib's safeApprove() does not set allowance 0 first which would lead to the escrow encountering issues when dealing with tether's USDT or tokens like it.

Lines of code Vulnerability details Impact Medium... a number of features within the protocol will not work if an approval reverts in the escrow or anywhere else NB: Report mainly focuses on the usage of the SafeTransferLib's safeApprove, but bug is attached to the underlying call made to approve...

The DelegateToken.approve function will directly overwrite the old user's approval, resulting in a loss of user rights

Lines of code Vulnerability details Impact DelegateToken.approve will override the old approval with the same delegateId. This will directly impact the rights of users who were previously approved, effectively revoking their previous approval. function approveaddress spender, uint256...

No way to revoke Approval in DelegateToken.approve leads to un authorized calling of DelegateToken.transferFrom

Lines of code Vulnerability details Impact There is no way to revoke the approval which given via DelegateToken.approveaddress,delegateTokenId. They can able call the DelegateToken.transferFrom even the tokenHolder revoke the permission using the DelegateToken.setApprovalForAll if the spender...