CISA Sets a Deadline - Patch Juniper Junos OS Flaws Before November 17

The U.S. Cybersecurity and Infrastructure Security Agency CISA has given a November 17, 2023, deadline for federal agencies and organizations to apply mitigations to secure against a number of security flaws in Juniper Junos OS that came to light in August. The agency on Monday added five...

7cd.cn Cross Site Scripting vulnerability OBB-3776235

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

M-06 Unmitigated

Lines of code Vulnerability details Mitigation of M-06: Issue NOT mitigated Mitigated issue M-06: Missing deadline check for AfEth actions The issue was missing deadline checks for deposits and withdrawals. Mitigation review - missing deadline for rewards Deadline parameters have been added to...

gobopro.de Cross Site Scripting vulnerability OBB-3764388

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

disallowing the executor to sign the transaction with the expiryEpoch will may allow or prevent the transaction to be executed in a wrong time for the executor, who is the responsible for performing the strategies, and will hamper the automation process

Lines of code Vulnerability details Impact preventing the executor from setting an ExpiryEpoch to the transaction to be executed within it , will lead to hamper the automation process and may allow the transactions to be executed in improper time in which the strategy became invalid which may cau...

CVE-2023-42448

CVE-2023-42448 describes a vulnerability in Hydra (Cardano) prior to version 0.13.0 where the contestation period in the head UTxO datum could be modified during the Close transaction because the checkClose path does not enforce the required deadline. This could let a malicious participant fanout...

CVE-2023-42448 Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline

Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed Close transaction, but no such check appears to be...

Hydra Input Validation Error Vulnerability

Hydra is a penetration testing tool. An input validation error vulnerability exists in versions of Hydra prior to 0.13.0 that stems from allowing a malicious participant to modify the competition deadline in the header...

PT-2023-28348 · Hydra · Hydra

Name of the Vulnerable Software and Affected Versions: Hydra versions prior to 0.13.0 Description: Hydra is the layer-two scalability solution for Cardano. The issue arises because the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses...

Missing deadline check for AfEth actions

Lines of code Vulnerability details Summary AfEth main actions execute on-chain swaps and lack an expiration deadline, which enables pending transactions to be maliciously executed at a later point. Impact Both AfEth deposits and withdrawals include on-chain swaps in AMM protocols as part of thei...

giannispanousis.gr Cross Site Scripting vulnerability OBB-3694584

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

requestDeposit and requestRedeem do not allow for any price guarantee, opening users to sandwich attacks and other losses

Lines of code Vulnerability details Impact Request functions take only the desired input amount as a parameter, giving no way for the caller to control the fulfilment price. The price is decided by the Centrifuge mainnet only. function requestDeposituint256 assets, address owner; function...

Swapping lacks deadline check

Lines of code Vulnerability details Impact There is no deadline when swapping tokens using EvolvingProteus. Swaps that are done through low gas transactions may be stuck in the mempool for a long time, resulting in unfavourable swap. Proof of Concept Evolving prometeus seems like an upgrade to...

No deadline check when swapping tokens in swapGivenInputAmount() and swapGivenOutputAmount

Lines of code Vulnerability details Impact Missing deadline checks allow pending transactions to be maliciously executed in the future. Without deadline parameters, as a consequence, users can have their operations executed at unexpected times, when the market conditions are unfavorable. Proof of...

Some functions in TokenisableRange contracts does not allow user to deadline.

Lines of code Vulnerability details Impact Not allowing users to supply their own deadline could potentially expose them to sandwich attacks Proof of Concept Consider the following scenario: if fee0 100 bal0 && fee1 100 bal1 TOKEN0.token.safeIncreaseAllowanceaddressPOSMGR, fee0;...

Missing deadline param in swapExactAmountOut() allowing outdated slippage and allow pending transaction to be executed unexpectedly.

Lines of code Vulnerability details Impact Loss of funds/tokens for the protocol, since block execution is delegated to the block validator without a hard deadline. Proof of Concept The function swapExactAmountOut from LiquidationRouter.sol and LiquidationPair.sol use these methods to swap tokens...

swapExactAmountOut() does not have deadline which allows pending transactions to be maliciously executed

Lines of code Vulnerability details Impact In LiquidationRouter.sol, swapExactAmountOut function has no deadline for the transaction when swapping. File: src/LiquidationRouter.sol function swapExactAmountOut LiquidationPair liquidationPair, address receiver, uint256 amountOut, uint256 amountInMax...

deadline using swap functions does not verify that the deadline has passed/expired

Lines of code Vulnerability details Impact In V3Proxy.sol contract, deadline is used in functions like swapExactTokensForTokens, swapTokensForExactTokens, swapExactETHForTokens, swapETHForExactTokens, swapTokensForExactETH and swapExactTokensForETH etc to ensure that the transaction can be execut...

swapExactAmountOut() no deadline protection

Lines of code Vulnerability details Impact no deadline protection , users may suffer losses Proof of Concept LiquidationRouter.swapExactAmountOut use for swap tokens. However, currently only amountInMax slippage protection is provided, and not deadline protection like the common AMMS protection...

SETTING block.timestamp AS THE DEADLINE COULD LEAD TO HIGHER RATE OF FAILED TRANSACTIONS

Lines of code Vulnerability details Impact The OptionsPositionManager.swapExactTokensForTokens function is used to swap assets for exact assets. Here the exact amount of source token is swapped for an amount of target token. The function uses the IUniswapV2Router01.swapExactTokensForTokens call f...