RHEL 7 : xorg-x11-server (RHSA-2023:6802)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6802 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user...

kernel: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation

In the Linux kernel, the following vulnerability has been resolved: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation In function rt6nlmsgsize, the length of nexthop is calculated by multipling the nexthop length of fib6info and the number of siblings. However if the fib6info h...

Fedora 39 : xorg-x11-server-Xwayland (2023-2eb445d52b)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-2eb445d52b advisory. Xwayland 23.2.2 ---- Security fix for CVE-2023-5367 Tenable has extracted the preceding description block directly from the Fedora security advisory...

SocializeLoss can revert in underflow

Lines of code Vulnerability details Impact SocializeLoss can revert in underflow so the admin cannot socalize loss properly Proof of Concept SocializeLoss can revert in underflow so the admin cannot socalize loss properly In the current implementation of the socialize loss uint256 amount =...

Users pay higher fee than intended

Lines of code Vulnerability details Impact Protocol mints incorrect depositAmount and depositShare to protocol. Such that reserveFee is higher than defined. Suppose following scenario: 1. Tranche 2 has 20% APR, has 5000 borrowed 2. Tranche 1 has 10% APR, has 10000 borrowed 3. ReserveFee is 10% 4...

Upgraded Q -> 2 from #430 [1699028562977]

Judge has assessed an item in Issue 430 as 2 risk. The relevant finding follows: It’s not clear which token the OD token will be paired with in order to determine the price in the uniV3Relayer contract. Then the following lines are problematic: baseAmount = uint12810...

The _transferToBeneficiary() incorrectly assumes Native ETH amount and ERC20 Token amount as 1:1.

Lines of code Vulnerability details Impact The transferToBeneficiary function of EthenaMinting.sol incorrectly assumes Native ETH amount and ERC20 Token amount as 1:1. Proof of Concept The transferToBeneficiary function is used in redeem function of EthenaMinting.sol. Though, you are not allowed ...

Vesting amount is calculated incorrectly in StakedUSDe contract

Lines of code Vulnerability details Description The description says vestingAmount is the contract balance + any unvested remainder at that time but it is set incorrectly in the code. /// @notice The amount of the last asset distribution from the controller contract into this /// contract + any...

stellar-strkey vulnerable to panic in SignedPayload::from_payload

Impact Panic vulnerability when a specially crafted payload is used. This is because of the following calculation: rust innerpayloadlen + 4 - innerpayloadlen % 4 % 4 If innerpayloadlen is 0xffffffff, 4 - innerpayloadlen % 4 % 4 = 1 so rust innerpayloadlen + 4 - innerpayloadlen % 4 % 4 = u32::MAX ...

Function _joinCollateral calculates variable wei incorrectly for collateral tokens that do not have 1e18 decimals

Lines of code Vulnerability details Impact Collateral tokens with decimals other than 1e18 will not work. Proof of Concept Function joinCollateral in CommonActions.sol, which is inherited by BasicActions.sol in scope calculates the collateral token amount wrongly for all non 1e18 decimal tokens...

[ADRIRO-NEW-H-02] Users loses their share of rewards while waiting for withdrawal

Lines of code Vulnerability details Summary Withdrawals in AfEth undergo a delay until the underlying CVX tokens can be withdrawn. Depositors need to request a withdrawal and wait until the required withdrawal epoch before making their withdrawal effective. During this period of time, they will...

FreeBSD : xorg-server -- Multiple vulnerabilities (9e2fdfc7-e237-4393-9fa5-2d50908c66b3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9e2fdfc7-e237-4393-9fa5-2d50908c66b3 advisory. - The X.Org project reports: When prepending values to an existing property an invalid offset...

xorg-server -- Multiple vulnerabilities

The X.Org project reports: ZDI-CAN-22153/CVE-2023-5367: X.Org server: OOB write in XIChangeDeviceProperty/RRChangeOutputProperty When prepending values to an existing property an invalid offset calculation causes the existing values to be appended at the wrong offset. The resulting memcpy would...

SafeDeployer : calling the function _genNonce would overflow.

Lines of code Vulnerability details Impact Genosis safe account can not be created due to overflow of genNonce Proof of Concept The contract SafeDeployer deploy the Genosys safe account. To this, there are set of function which accomplish this task. First the function deployConsoleAccount will be...

CVE-2023-41752 Apache Traffic Server: s3_auth plugin problem with hash calculation

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue...

CVE-2023-41752 Apache Traffic Server: s3_auth plugin problem with hash calculation

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue...

Timing Attack

Harbor is vulnerable to timing attacks. The vulnerability is due the comparison of secrets which are not run in constant time. This allows an attacker to decipher response times for cryptographic calculation and secret enumeration, which can result in sensitive information disclosure...

Same multiple delegate values result in wrong calculation of delegated votes

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. If by mistake same delegate value is given multiple times to targets array then delegation of votes is wrongly calculated. Proof of Concept Provide direct links to all referenced code in GitHub. Add...

LiquidityMining.claimConcentratedRewards() does not properly account user liquidity across ticks

Lines of code Vulnerability details Let’s say a user creates two separate positions, one is tick-15, tick and the second is tick, tick+15. The user is covering the entirety of the tick range to receive rewards but does not receive any. We see that posKey is defined like this: bytes32 posKey =...

Global and Position liquidity accrual can significantly impact the performance

Lines of code Vulnerability details Impact Global and Position liquidity accrual can significantly impact the performance Proof of Concept The calculation of currWeek and nextWeek as shown in the provided code snippet aims to determine two time points within a week, primarily for the purpose of...