2195 matches found
Incorrect Target Amount Calculation with Different Decimals in OptionPositionManager Contract
Lines of code Vulnerability details Bug Description In the OptionPositionManager contract, at line 524, there is a calculation error in the implementation of the getTargetAmountFromOracle function. This function calculates the target amount amountB based on the prices of assets A and B obtained...
Wrong calculation of debt in function close0 may lead to loss of funds.
Lines of code Vulnerability details Impact In the function close, the debt was equated to the repayAmount after checking that repayAmountis greater than zero and less than the debt. Consider a situation where a user is owing 10 tokens and wants to repay 3 tokens. since 3 passes the check of being...
Calc token amount can be manipulated
Lines of code Vulnerability details Impact function calcDepositInOneCoin uint2563 memory arr private view returns uint256 return liquidityPool.calctokenamountarr, true; This function is being used to calculate slippage, return value calctokenamount can be manipulated as described in POC section,...
addCollateral allows anyone to addCollateral on behalf of others
Lines of code Vulnerability details Impact addCollateral allows anyone to addCollateral on behalf of others. In other words, bypassing the borrow allowance check. Proof of Concept allowedBorrow modifier will not revert if passed share == 0. addCollateral method uses allowedBorrow modifier functio...
Mozilla: Potential permissions request bypass via clickjacking
The Mozilla Foundation Security Advisory describes this flaw as: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions...
Mozilla: Potential permissions request bypass via clickjacking
The Mozilla Foundation Security Advisory describes this flaw as: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions...
Mozilla: Potential permissions request bypass via clickjacking
The Mozilla Foundation Security Advisory describes this flaw as: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions...
Mozilla: Potential permissions request bypass via clickjacking
The Mozilla Foundation Security Advisory describes this flaw as: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions...
CVE-2023-4047
The Mozilla Foundation Security Advisory describes this flaw as: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions...
Mozilla Thunderbird < 102.14
The version of Thunderbird installed on the remote Windows host is prior to 102.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-32 advisory. - Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and...
CVE-2023-4047
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...
CVE-2023-4047
CVE-2023-4047 is a vulnerability in Firefox popup notifications delay calculation that could allow an attacker to trick a user into granting permissions. The issue affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR
CVE-2023-4047
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...
CVE-2023-4047
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...
Incorrect liquidity calculations if snapshot errors occur
Lines of code Vulnerability details Impact incorrect liquidity values that undermine the risk checks and constraints of the protocol Proof of Concept getHypotheticalAccountLiquidityInternal does not handle snapshot errors properly. Specifically: It calls MToken.getAccountSnapshot to get the...
Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2023-2471)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
More collateral is seized than approved
Lines of code Vulnerability details Impact More collateral is seized outside of the comptroller's approved liquidation amount which means excess seizeTokens are transferred from the borrower to the liquidator leading to loss of funds Proof of Concept liquidateBorrowFresh first checks the allowanc...
Attacker can Steal all eths of WETHRouter.sol through redeem function
Lines of code Vulnerability details Impact An attacker can Steal eths through redeem function in WETHRouter.sol as you know the contract does the redeem process and redeem user mTokens to ETHs, and as you know we have the function of mint which is the opposite of this and users deposit ETH in ord...
ARCDVestingVault._syncVotingPower could revert if newVotingPower is big enough.
Lines of code Vulnerability details Impact ARCDVestingVault.syncVotingPower calculate the change in voting power using int256newVotingPower - int256grant.latestVotingPower. If newVotingPower is greater than typeint256.max, ARCDVestingVault.syncVotingPower could revert. Proof of Concept...
libsndfile_project -- Integer overflow in dataend calculation
[email protected] reports: Multiple signed integers overflow in function aureadheader in src/au.c and in functions mat4open and mat4readheader in src/mat4.c in Libsndfile, allows an attacker to cause Denial of Service or other unspecified impacts...