307 matches found
It is expected that some functions may require either Owner or Delegate as callers. Now only three access options are available: onlyOwner, onlyDelegate, anyone.
Handle Sherlock Vulnerability details Impact That is strange behavior that some functions are available for a Delegate, but not available for an owner himself. Like lock and unlock - according to the understanding of the Visor's design, these functions should be available for the owner as well...
A previously timelocked NFT token becomes permanently stuck in vault if it’s ever moved back into the vault
Handle 0xRajeev Vulnerability details Impact Let’s consider a scenario where a particular NFT token was timelocked for a certain duration by the owner using timeLockERC721 with a delegate as the recipient and then transferred out of the vault by the delegate via transferERC721 but without unlocki...
Anyone can call onERC721Received() function and spam the array "nfts"
Handle Sherlock Vulnerability details Impact An attacker can deal direct economic damage to the owner/delegate spending some gas to spam the array of "nfts" with different values. It will be more costly to remove these nfts one-by-one, transaction-by-transaction. Also, it makes other functions...
function transferERC721 does not reset nftApprovals if the msg.sender is a delegate
Handle paulius.eth Vulnerability details Impact When the sender is not the owner, the function transferERC721 checks that the sender has nftApprovals set to true. However, after doing the transfer, it does not reset it to false. Maybe that was intended here, but comparing to the function...
PT-2021-11381 · Canonical +1 · Snapd +2
Name of the Vulnerable Software and Affected Versions: snapd affected versions not specified Description: The issue arises when generating systemd service units for the docker snap and similar snaps, as snapd fails to specify Delegate=yes. As a result, systemd moves processes from containers...
CVE-2020-27352
When generating the systemd service units for the docker snap and other similar snaps, snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading syst...
UBUNTU-CVE-2020-27352
When generating the systemd service units for the docker snap and other similar snaps, snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading syst...
Zivver: one delegate can add another delegate and delete other delegates, exposing all confidential inbox messages
Summary: One Delegate can add another delete and delete other delegates, exposing all inbox messages to other delegates and hence exposing all the confidential info can be seen by newly added delegates Steps To Reproduce: add details for how we can reproduce the issue 1. Login as User1 and add a...
resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class
A flaw was found in Resteasy, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed...
resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class
A flaw was found in Resteasy, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed...
CVE-2020-8495
In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and...
CVE-2020-8495
In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and...
CVE-2020-8495: Missing Authorization
In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and...
PT-2020-20175
Name of the Vulnerable Software and Affected Versions Kronos Web Time and Attendance webTA versions 3.8.x through 3.x before 4.0 Description The issue allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application. This is achieve...
CVE-2015-7556
DeleGate 9.9.13 allows local users to gain privileges as demonstrated by the dgcpnod setuid program...
Design/Logic Flaw
DeleGate 9.9.13 allows local users to gain privileges as demonstrated by the dgcpnod setuid program...
CVE-2015-7556
DeleGate 9.9.13 allows local users to gain privileges as demonstrated by the dgcpnod setuid program...
CVE-2015-7556
DeleGate 9.9.13 is affected by a local privilege escalation vulnerability. The issue arises from setuid root binaries (notably dgcpnod) that can be abused by local users to gain root privileges. Exploitation details are documented in multiple public references (e.g., Vapidlabs advisory, 1337DAY e...
PT-2020-7895
Name of the Vulnerable Software and Affected Versions: DeleGate version 9.9.13 Description: The issue allows local users to gain privileges, as demonstrated by the dgcpnod setuid program. Recommendations: For DeleGate version 9.9.13, at the moment, there is no information about a newer version th...