Security Bulletin: Multiple IBM Db2 Server Vulnerabilities Affect IBM Emptoris Contract Management

Summary Multiple IBM Db2 Server vulnerabilities affect IBM Emptoris Contract Management. Vulnerability Details CVEID: CVE-2021-20579 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL...

Security Bulletin: IBM Db2 Server Vulnerability Affects IBM Emptoris Contract Management (CVE-2021-29702)

Summary An IBM Db2 Server vulnerability affects IBM Emptoris Contract Management. Vulnerability Details CVEID: CVE-2021-29702 DESCRIPTION: Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.1.4 and 11.5.5 is vulnerable to a denial of service as the server terminates abnormally when...

finalize is susceptible to front-running leading to DoS and contract redeployment

Handle 0xRajeev Vulnerability details Impact PostAuctionLauncher finalize has removed the requirement of admin-only finalize as noted in the function comment and lets anyone call it. This makes it susceptible to front-running by anyone when tokens token1 or token2 are yet to be added to pool. The...

Last person to withdraw his tokens might not be able to do this, in Crowdsale (edge case)

Handle gpersoon Vulnerability details Impact Suppose a Crowdsale is successful and enough commitments are made before the marketInfo.endTime. Suppose marketStatus.commitmentsTotal == marketInfo.totalTokens -1 // note this is an edge case, but can be constructed by an attacker Then the function...

YAxisVotePower.balanceOf can be manipulated

Handle cmichel Vulnerability details The YAxisVotePower.balanceOf contract uses the Uniswap pool reserves to compute a lpStakingYax reward: uint256 yaxReserves,, = yaxisEthUniswapV2Pair.getReserves; int256 lpStakingYax = yaxReserves .mulstakeAmount .divsupply .addrewardsYaxisEth.earnedvoter; The...

earn results in decreasing share price

Handle jonah1005 Vulnerability details Impact For a dai vault that pairs with NativeStrategyCurve3Crv, every time earn is called, shareholders would lose money. about 2% There're two issues involved. The Vault contract and the controller contract doesn't handle the price difference between the wa...

set cap breaks vault's Balance

Handle jonah1005 Vulnerability details Impact In controller.sol's function setCap, the contract wrongly handles vaultDetailsvault.balance. While the balance should be decreased by the difference of strategies balance, it subtracts the remaining balance of the strategy. Controller.solL262-L278...

Potential DOS in Contracts Inheriting UUPSUpgradeable.sol

Handle leastwood Vulnerability details Impact There are a number of contracts which inherit UUPSUpgradeable.sol, namely; GovernanceAction.sol, PauseRouter.sol and NoteERC20.sol. All these contracts are deployed using a proxy pattern whereby the implementation contract is used by the proxy contrac...

Access restrictions on CompoundToNotionalV2.notionalCallback can be bypassed

Handle cmichel Vulnerability details Vulnerability Details The CompoundToNotionalV2.notionalCallback is supposed to only be called from the verified contract that calls this callback but the access restrictions can be circumvented by simply providing sender = this as sender is a parameter of the...

notionalCallback can be tricked by anyone

Handle pauliax Vulnerability details Impact Anyone can call function notionalCallback with arbitrary params and pass the auth check. The only auth check can be easily bypassed by setting sender param to the address of this contract. It allows to choose any parameter that I want: function...

Downcasting Can Freeze The Chain

Handle nascent Vulnerability details M-01 Downcasting Can Freeze The Chain Severity: Medium Likelihood: Low The function utils::downcastuint256 - Option returns None if the input value is greater than U64MAX. If the value being downcast is read from a contract e.g. a nonce, and the contract could...

CVE-2020-19765

An issue in the noReentrance modifier of the Ethereum-based contract Accounting 1.0 allows attackers to carry out a reentrancy attack...

Design/Logic Flaw

An issue in the noReentrance modifier of the Ethereum-based contract Accounting 1.0 allows attackers to carry out a reentrancy attack...

CVE-2020-19765

An issue in the noReentrance modifier of the Ethereum-based contract Accounting 1.0 allows attackers to carry out a reentrancy attack...

CVE-2020-19765

Technical details about CVE-2020-19765 are not publicly provided in the supplied documents. References mention a reentrancy issue in Accounting 1.0 but lack concrete affected components, versions, exploit paths, or remediation. Monitor for updates.

Does the cosmos-sdk listen to only 1 gravity.sol contract address?

Handle tensors Vulnerability details Recently Thorchain which uses cosmos, was hacked because the Thorchain environment listened to emitted events from routers other than the intended one. This allowed a hacker to create a malicious router. Within the ethmainloop of the orchestrator, is the...

Reentrancy Bug in TimelockController.sol

Handle leastwood Vulnerability details Impact Notional's governance framework utilises a fork of Compound's Governor Alpha and ERC20 token. These are denoted specifically as the GovernorAlpha.sol and NoteERC20.sol contracts. However, the GovernorAlpha.sol has a key difference when compared to...

ZOHO ManageEngine ServiceDesk Plus Licensing Issue Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, etc. An authorization issue vulnerability exists in...

@hyperledger/cactus-example-carbon-accounting-backend (>=0.5.0-alpha.0, <=0.8.0), @leap-network/pooltogether-proxy-factory (1.0.0-beta.2) +31 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=3.4.0, <=3.4.1)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.5.0-alpha.0, =1.0.0, =1.0.0-beta.1, =0.7.12, =0.3.0, =0.1.0, =0.4.0, =0.7.12, =0.7.12, =0.0.1, =0.7.7, =0.8.18 and more Source cves: CVE-2021-39168 Source advisory: OSV:GHSA-VRW4-W73R-6MM8...

0x-hunter-core (>=1.0.0-33, <=1.0.0-38), @0xabcdefg/router-sdk (1.0.0) +1963 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=3.3.0, <=3.4.1-solc-0.7-2)

@openzeppelin/contracts NPM version =3.3.0, =1.0.0-33, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.0.0, =0.2.0, =4.14.3, =4.14.5 and more Source cves: CVE-2021-39167 Source advisory: OSV:GHSA-FG47-3C2X-M2WR...