Yield may be stolen by MEV bot by sandwiching harvest()

Lines of code Vulnerability details Impact Yield may be stolen by MEV bot by sandwiching harvest. Because of minimum output amount of swapping is set to 0. Which mean MEV bot can pump price of AURA token to the highest price before your strategy swap to let you buy AURA token at an incredibly hig...

Vault can never fully be emptied

Lines of code Vulnerability details Impact Vault cannot be fully emptied Proof of Concept Whenever rewards are earned they are automatically locked into the the Aura Locker. Since that reward will then earn more rewards while locked, there will be more rewards to be collected when that lock is...

Reward token (auraBal) can be locked in the strategy

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. getRewardaddress account function of Aura Locker is an external function therefore can be called by anyone by passing in the address of strategy and transferring the rewards to the strategy. harvest...

reentrancy by _harvest() and _deposit() code in the middle of claimBribesFromHiddenHand() external calls to tokens and change balances of AURA token so claimBribesFromHiddenHand() make wrong transfers and fund would be lost

Lines of code Vulnerability details Impact Function claimBribesFromHiddenHand makes some external calls to token lists which fetches from hiddenHandDistributor.rewards if AURA was on of those tokens and also one of those tokens were malicious or made some external call then it's possible to reent...

CVE-2021-21199

Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page...

CVE-2021-30510

Use after free in Aura in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Salesforce Lightning Objects Guest Permissions

Salesforce Lightning is a component-based framework which is designed to help organizations building data-driven SaaS applications. By assembling those components called Aura components, developers can quickly create custom web pages in their Salesforce application and perform specific actions on...

CVE-2022-22262 ASUS Armoury Crate & Aura Creator Installer之ROG Live Service - Improper Link Resolution Before File Access

ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this function does not validate the path before deletion, an unauthenticated local attacker can create an unexpected symbolic link to system file pat...

U.S. General Services Administration: Registered users contact information disclosure on salesforce lightning endpoint https://disposal.gsa.gov

Hi, Sample of the Information Disclosure is below. More records are attached -███ "LastName":"████","FullNamec":"█████████","Id":"██████████","MailingStreet":null,"Activec":false,"Emailc":null,"LastModifiedBy":"Id":"00530000009KyDqAAK","Name":"SNA...

The vulnerability of the Aura web browser component of Google Chrome, related to the use of memory after its release, allows a hacker to gain access to confidential data, compromise their integrity, and cause service interruptions.

The vulnerability of the Aura web browser component of Google Chrome is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and cause service interruptions through a specially...

d.aura-soma.co.jp Cross Site Scripting vulnerability OBB-2136542

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

AuraBorealisApp - Do You Know What's In Your Python Packages? A Tool For Visualizing Python Package Registry Security Audit Data

AuraBorealis is a web application for visualizing anomalous and potentially malicious code in Python package registries. It uses security audit data produced by scanning the Python Package Index PyPI via Aura, a static analysis designed for large scale security auditing of Python packages. The...

The vulnerability of the Avaya Aura Device Services toolset lies in the creation of temporary files with insecure permissions, allowing a hacker to execute arbitrary code.

The vulnerability of the Avaya Aura Device Services toolset relates to the creation of temporary files with insecure permissions. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2021-25654

An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services...

CVE-2021-25654

An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services...

Remote code execution

An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services...

CVE-2021-25654

An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services...

CVE-2021-25654 Avaya Aura Device Services Arbitrary Code Execution Vulnerability

An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services...

CVE-2021-25654

CVE-2021-25654 affects Avaya Aura Device Services (versions 7.0–8.1.4.0). The root cause is an insecure temporary file handling mechanism that can allow a local user to craft and trigger scripts, leading to arbitrary code execution. Reports from multiple sources (PT Security, CNNVD, Red Hat/RedHa...

Avaya Aura Device Services 代码注入漏洞

Avaya Aura Device Services is a software application from Avaya, USA. It provides a feature for managing Avaya endpoints. A security vulnerability exists in Avaya Aura Device Services versions 7.0 through 8.1.4.0, which can be exploited by local users to execute specially written scripts...