1948 matches found
Groupbuy: _verifyUnsuccessfulState and _verifySuccessfulState both can return true when block.timestamp == pool.terminationPeriod
Lines of code Vulnerability details Impact The functions verifyUnsuccessfulState and verifySuccessfulState should always have a differing behavior with regards to reversion, i.e. when one does not revert, the other should revert. In one condition, this is not true. Namely, when we have pool.succe...
In consistent parameters settings can break the business logic
Lines of code Vulnerability details Impact The usual business logic of the raffle should be that: If a user wins a raffle, he can always claim the NFT before a redraw can be initialized. However, the settings parameters can be set to inconsistent so that a winner may not be able to claim the NFT...
Admin can call claim fee multiple times with no restriction
Lines of code Vulnerability details Impact Admin can call claim fee multiple times to drain the fund in the pool Proof of Concept Admin can perform certain actions in the Pool.sol function adminActionuint256 action, uint16 val, address recipient external checkReentrancytrue, true; // reentrancy...
avrisp (0.3.0), brood (0.1.0) +23 more potentially affected by unknown CVE via claim (>=0.3.1, <=0.5.0)
claim CARGO version =0.3.1, =0.1.0, =0.2.0, =0.1.1, =0.1.0, =0.0.1, =0.0.2, =0.9.0, =0.8.0, =0.2.0, =0.4.0, =1.0.2, =1.2.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0077...
PT-2022-37430 Ā· Claim Ā· Claim
Name of the Vulnerable Software and Affected Versions: claim affected versions not specified Description: The issue concerns the claim crate, which has not seen a release since February 2021 and has an unresponsive maintainer. A pending issue with the claim crate's dependencies makes it difficult...
Incentive fund loss when calling claim() in AutoPxGlp/PxGmxRewards because it calls this.compound(,,true) which would transfer incentive to contract itself and those funds won't be calculated as rewards or fee and won't be accessible to withdraw
Lines of code Vulnerability details Impact Function claim in PxGmxReward contract is used for claiming available pxGMX rewards of a user. but this function calls IAutoPxGlpaddressthis.compound1, 1, true; to harvest new rewards and stake them to compound rewards. but this call is external call and...
fee loss in AutoPxGmx and AutoPxGlp and reward loss in AutoPxGlp by calling PirexRewards.claim(pxGmx/pxGpl, AutoPx*) directly which transfers rewards to AutoPx* pool without compound logic get executed and fee calculation logic and pxGmx wouldn't be executed for those rewards
Lines of code Vulnerability details Impact Function compound in AutoPxGmx and AutoPxGlp contracts is for compounding pxGLP and additionally pxGMX rewards. it works by calling PirexGmx.claimpx, this to collect the rewards of the vault and then swap the received amount to calculate the reward,...
Division by zero could cause DOS in function harvest() and claim() in PirexRewards contract
Lines of code Vulnerability details Impact When functions harvest or claim of PirexRewards are called, they will claim rewards by calling PirexGmx.claimRewards function. If there is any case that esGmx reward is existed but not base rewards or vice versa, the value returned from calculateRewards ...
DoS on claiming rewards in PirexRewards is possible
Lines of code Vulnerability details Proof of Concept The claim method in PirexRewards iterates over the rewardTokens array for a producerToken. Now this array is completely managed by the contractās owner who can call addRewardToken which pushes a new value in that array, as many times as he...
CVE-2022-44117
Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties because Boa does not ship with any support for SQL...
org.jenkins-ci.plugins.workflow:workflow-cps (>=2.40, <=2.41), org.jenkins-ci.plugins:claim (>=2.10, <=2.15) +3 more potentially affected by CVE-2022-45379 via org.jenkins-ci.plugins:script-security (1.34)
org.jenkins-ci.plugins:script-security MAVEN version 1.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps =2.40, =2.10, =1.7, =1.2.5, =1.2.5,...
org.jenkins-ci.plugins.workflow:workflow-cps (>=2.40, <=2.41), org.jenkins-ci.plugins:claim (>=2.10, <=2.15) +3 more potentially affected by CVE-2022-43401 +3 more via org.jenkins-ci.plugins:script-security (1.34)
org.jenkins-ci.plugins:script-security MAVEN version 1.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps =2.40, =2.10, =1.7, =1.2.5, =1.2.5,...
org.jenkins-ci.plugins.workflow:workflow-cps (>=2.40, <=2.41), org.jenkins-ci.plugins:claim (>=2.10, <=2.15) +3 more potentially affected by CVE-2022-43401 +3 more via org.jenkins-ci.plugins:script-security (1.34)
org.jenkins-ci.plugins:script-security MAVEN version 1.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps =2.40, =2.10, =1.7, =1.2.5, =1.2.5,...
A malicious user can claim and successfuly steal a gobbler NFT token.
Lines of code Vulnerability details Impact A malicious user can claim and successfuly steal a gobbler NFT token in the function claimGobbler. Proof of Concept The function claimGobbler is used from the mintlisted users to claim a gobbler using a merkle proof. However there is no check to ensure...
DEBIAN-CVE-2022-35951
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an XAUTOCLAIM command on a stream key in a specific state, with a specially crafted COUNT argument may cause an integer overflow, a subsequent heap...
ALPINE-CVE-2022-35951
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an XAUTOCLAIM command on a stream key in a specific state, with a specially crafted COUNT argument may cause an integer overflow, a subsequent heap...
UBUNTU-CVE-2022-35951
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an XAUTOCLAIM command on a stream key in a specific state, with a specially crafted COUNT argument may cause an integer overflow, a subsequent heap...
CVE-2021-41803
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...
ALPINE-CVE-2021-41803
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...
CVE-2021-41803
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...