avotes-parser-cli (=0.5.0), avotes-parser-core (=0.5.0) +4 more potentially affected by CVE-2023-42441 via vyper (>=0.3.0 <=0.3.1)

vyper PYPI version =0.3.0, =1.17.0, =2.1.6, =1.1.1.dev56, =1.3.0 Source cves: CVE-2023-42441 Source advisory: OSV:PYSEC-2023-305...

avotes-parser-cli (=0.5.0), avotes-parser-core (=0.5.0) +4 more potentially affected by CVE-2023-42441 via vyper (>=0.3.0 <=0.3.1)

vyper PYPI version =0.3.0, =1.17.0, =2.1.6, =1.1.1.dev56, =1.3.0 Source cves: CVE-2023-42441 Source advisory: OSV:GHSA-3HG2-R75X-G69M...

ETH Founder Vitalik Buterin’s X (Twitter) Hacked, $700k Stolen

By Deeba Ahmed The hacker enticed victims with a malicious link, promising free commemorative NFTs and stole all the funds once they connected their wallets. This is a post from HackRead.com Read the original post: ETH Founder Vitalik Buterins X Twitter Hacked, $700k Stolen...

MAL-2023-8083 Malicious code in web3tool-eth-ens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f519c2e49729df67c6bf4c20af192d98f35adf19e6be605e44a81b902e127762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3tool-eth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b8144961cdbbf3863f7d33cd189f30f5ddac08c9e65c7604ffa91e189ebd53e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3tool-eth-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b88af56a13a201401e73df39e1314844c1be994b5d3675145d4faa8ec9f8e663 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8081 Malicious code in web3tool-eth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b8144961cdbbf3863f7d33cd189f30f5ddac08c9e65c7604ffa91e189ebd53e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8071 Malicious code in eth-web3-tx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c442b5b546b5967c812942b37c649d2e7caa2675e942bd96ddf40cbee1174f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8084 Malicious code in web3tool-eth-personal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eacd67d6f3ad1e3b4f75c7ca18d9ea92cea75c57b72d37158f24f58e72fa766f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3tool-eth-ens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f519c2e49729df67c6bf4c20af192d98f35adf19e6be605e44a81b902e127762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eth-web3-tx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c442b5b546b5967c812942b37c649d2e7caa2675e942bd96ddf40cbee1174f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8082 Malicious code in web3tool-eth-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b88af56a13a201401e73df39e1314844c1be994b5d3675145d4faa8ec9f8e663 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Incorrect price precision in RdpxV2Core

Lines of code Vulnerability details Impact The core contract expects the price oracle to return 1e8 precision, but its actually 1e18. This will cause heavily incorrect results from all usages of the price. Proof of Concept The RdpxV2Core.getRdpxPrice function is meant to return 1e8 precision:...

polyphys-s01.ethz.ch Cross Site Scripting vulnerability OBB-3646521

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Google Introduces First Quantum Resilient FIDO2 Security Key Implementation

Google on Tuesday announced the first quantum resilient FIDO2 security key implementation as part of its OpenSK security keys initiative. "This open-source hardware optimized implementation uses a novel ECC/Dilithium hybrid signature schema that benefits from the security of ECC against standard...

LendingLedger.sol sends ETH instead of CANTO

Lines of code Vulnerability details Impact In the documentations for the contest it is clearly stated that LendingLedger contract is expected to send CANTO to the user when they call the claim function but in reality it transfers ETH. This could be problematic if the user is a contract that expec...

receive() in LendingLedger should be replaced by an appropriate function to prevent users from sending native by mistake

Lines of code Vulnerability details Impact Users lose funds by transferring them by mistake to LendingLedger. Proof of Concept Since the LendingLedger contract has a receive external payable function which receives native without any validation, which means that anyone can transfer native to it b...

receive function allows any user to lose funds

Lines of code Vulnerability details Impact Lending ledger receive function allows for any user to send funds and lose them forever. Proof of Concept Any user that sends funds to the Lending Ledger contract through the receive function, can't withdraw their funds meaning they would be stuck in...

Claim reward can be inaccessible if msg.sender is a smart contract with no fallback/receive function

Lines of code Vulnerability details Impact When calling claim on LendingLedger, the claim reward can be inaccessible if msg.sender is a smart contract with no fallback/receive function. Indeed, msg.sender.callvalue: cantoToSend"" would fail and the claim would revert, not allowing the user to...

avotes-parser-cli (>=0.0.0 <=0.4.3), avotes-parser-core (>=0.0.0 <=0.4.3) +5 more potentially affected by CVE-2023-39363 via vyper (>=0.2.15 <=0.3.0)

vyper PYPI version =0.2.15, =0.0.0, =0.0.0, =0.4.3, =1.15.1, =0.2.1, =2.0.36, =2.1.22 Source cves: CVE-2023-39363 Source advisory: OSV:GHSA-5824-CM3X-3C38...