Can't create another claim for user which his claim was revoked / ended

Lines of code Vulnerability details Impact The admin can accidentally create the wrong claim for a user and then revoke it, or he would like to renew a vesting for a user which his vesting was ended. However, this is not possible, because the current claim's fields are not zeroed when it is revok...

The amountRemaining in withdrawAdmin() Function is Underflow

Lines of code Vulnerability details Impact allocatedTokens can get messed up when the amountRemaining in the withdrawAdmin function is underflowed in rare cases. This will make numTokensReservedForVesting will have a larger amount of funds compared to the funds in the token. This will make it...

The bytes allocated to linearVestAmount is too small in the struct VTVLVesting.Claim

Lines of code Vulnerability details Impact In baseVestedAmount of VTVLVesting.sol, when we calculate the vested amount, vestAmt is the sum of cliffAmount and linearVestAmount. linearVestAmount is calculated from the fraction of completed interval as follows. uint112 linearVestAmount =...

Revoking a claim blocks a recipient from withdrawing any unclaimed but due amount.

Lines of code Vulnerability details Impact Whenever an admin revokes a claim and the recipient has any unclaimed but vested balance , the unclaimed part is also revoked. Take for instance a total amount of 365 tokens vested over 1 year with a release interval of 1 day. If the recipient at day 30...

Revoking claim should regard accrued but not claimed tokens

Lines of code Vulnerability details Impact revokeClaim should send the user what is already vested at this moment before deactivating the claim. e.g. imagine a situation when a user has never claimed the tokens and has 90% already vested but suddenly the admin decides to revoke it and the user is...

Employee can be unable to withdraw claimable amount that she or he deserves after admin revokes her or his claim

Lines of code Vulnerability details Impact When an employee has an active claim, this employee can call the following withdraw function to withdraw the claimable amount that she or he is entitled to, which would increase her or his claim's amountWithdrawn. Because the employee is free to call...

CVE-2021-41803

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...

CVE-2021-41803

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...

PT-2022-4850

Name of the Vulnerable Software and Affected Versions: Redis versions 7.0.0 through 7.0.4 Description: The issue is related to an integer overflow when handling the COUNT argument in the XAUTOCLAIM command on a stream key in a specific state. This may cause a subsequent heap overflow and...

Can not Claim the second time per Spec requirement

Lines of code Vulnerability details Impact Reading the spec, MerkleReedeemerSpec "The user can claim a configurable amount of each ctoken, or all of them if possible" means, the claim amount can be called multiple times. Meanwhile, in RariMerkleRedeemer.sol, inside the claim function, it requires...

PT-2022-3806

Name of the Vulnerable Software and Affected Versions: Redis versions 7.0.0 through 7.0.3 Description: The issue is related to a heap overflow that can potentially lead to remote code execution. This occurs when a specially crafted XAUTOCLAIM command is executed on a stream key in a specific stat...

LTI 1.3 Tool Library's Nonce Claim Value not validated against nonce value sent in Authentication Request before v5.0

Impact Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Patches Users should upgrade to version 5.0 immediately Workarounds None...

CVE-2022-31158

LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0 to receive a patch. There are...

Authentication flaw

LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0 to receive a patch. There are...

CVE-2022-31158 Authentication Bypass by Capture-replay in packbackbooks/lti-1-3-php-library

LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0 to receive a patch. There are...

CVE-2022-31158 Authentication Bypass by Capture-replay in packbackbooks/lti-1-3-php-library

LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0 to receive a patch. There are...

LTI 1.3 Tool Library 加密问题漏洞

The LTI 1.3 Tool Library is a library of LTI 1.3 tool providers for building IMS certifications in PHP. A security vulnerability exists in the LTI 1.3 Tool Library prior to version 5.0, which stems from LTI 1.3 Tool Library is a library for building LTI 1.3 tool providers for IMS authentication i...

Griefing on claim()

Lines of code Vulnerability details Issue: griefing can happen if coolDownPeriod 0 due to the fact that you can stake for someone else. Whenever a stake happens, the expiry variable increases with coolDownPeriod. This can be done either by watching the mempool and frontrun a stake when someone...

griefing on claim()

Lines of code Vulnerability details Issue: griefing can happen if coolDownPeriod is 0 due to the fact that you can stake for someone else, whenever a stake happens, the expiry variable increases with coolDownPeriod. This can be done either by watching the mempool and frontrun a stake when someone...

DoS attack on claiming rewards can lead to user never being able to claim

Lines of code Vulnerability details Proof of Concept: the stake function can be called for a different recipient than msg.sender. Each time you stake tokens your warmUpInfo.expiry or the time when you are able to claim rewards grows by warmUpPeriod as is visible the last line here not the line wi...