PT-2022-15028 · Engine.Io +2 · Engine.Io +2

Content removed...

TimeswapPair.sol#mint() Lack of input validation allows attacker to set pool.state.y to an arbitrary target value

Handle WatchPug Vulnerability details pool.state.y += yIncrease; TimeswapPair.solmint takes a user input value of yIncrease without proper validation, which means that it allows the state of pool.state.y to increase by the arbitrary value set by the caller. Impact When pool.state.y is extremely...

CVE-2021-4155

A data leak flaw was found in the way XFSIOCALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them...

Borrow should increase principal by withdrawn amount

Handle cmichel Vulnerability details The CreditLine.borrow function increases the principal by the amount parameter, but the borrower only receives tokenDiffBalance. // @audit increases by amount instead of tokenDiffBalance creditLineVariablesid.principal =...

Cyber Monday Web Traffic Up Over 2020

Online retail traffic that Akamai delivered during Cyber Monday was up 5% globally compared to Cyber Monday 2020 and 31% compared to average Monday traffic...

Cyber Monday Web Traffic Up Over 2020

Online retail traffic that Akamai delivered during Cyber Monday was up 5% globally compared to Cyber Monday 2020 and 31% compared to average Monday traffic...

The role of runtime protection in eCommerce security

What is e-commerce security? E-commerce security is the set of guidelines that are designed to allow safe transactions on the web. These guidelines include steps and protocols that help protect the sale and purchase of goods and services online. Appropriate e-commerce security measures boost...

Black Friday Web Traffic Up Over 2020

Online retail traffic that Akamai delivered during Black Friday was up 2% globally compared to Black Friday 2020 and 14% compared to average Friday retail traffic. The modest year-over-year increase can be attributed to the significant rise in 2020 traffic due to COVID-19–related lockdowns and...

Anyone Can Arbitrarily Call FSDVesting.updateVestedTokens()

Handle leastwood Vulnerability details Impact The updateVestedTokens function is intended to be called by the FSD.sol contract when updating a user's vested token amount. A check is performed to ensure that user == beneficiary, however, as user is a user controlled argument, it is possible to spo...

Missing access restriction on Vesting.updateVestedTokens

Handle cmichel Vulnerability details The FSDVesting.updateVestedTokens function is supposed to be called by the FDS contract only which also mints tokens to the contract. However, it does not have any access restrictions which leads to circumventing the vesting and further griefing attacks. POC...

FSDVesting.updateVestedTokens doesn't have any control modifiers and anyone can increase vested amount for a beneficiary

Handle hyh Vulnerability details Impact In current implementation all vesting beneficiaries can increase their vested amounts unlimitedly by calling updateVestedTokensmyfsdvestingaddress, anyamounttobeaddedtovesting. Beneficiary can then surpass vesting schedule by calling claimVestedTokens It wi...

transferNotionalFrom doesn't check from != to

Handle gpersoon Vulnerability details Impact The function transferNotionalFrom of VaultTracker.sol uses temporary variables to store the balances. If the "from" and "to" address are the same then the balance of "from" is overwritten by the balance of "to". This means the balance of "from" and "to...

CVE-2021-23047

CVE-2021-23047 affects BIG-IP APM OCSP verification when the certificate contains AIA, causing undisclosed OCSP requests to increase memory usage (potential DoS). Public docs confirm affected product/component and root cause. Remediation per F5 advisory (K79428827): upgrade to fixed releases by b...

SUSE-SU-2021:2837-1 Security update for mariadb

This update for mariadb fixes the following issues: Update to version 10.2.40 bsc1189320: - fixes for the following security vulnerabilities: CVE-2021-2372 and CVE-2021-2389 In additon the follwing was changed: - Increase NOFILE limit on service configuration bsc1180014 The default 'NOFILE' setti...

OPENSUSE-SU-2021:2791-1 Security update for fetchmail

This update for fetchmail fixes the following issues: - CVE-2021-36386: Fixed a missing variable initialization that can cause read from bad memory locations. bsc1188875 - Change PASSWORDLEN from 64 to 256 bsc1188034...

CVE-2021-34272

A security flaw in the 'owned' function of a smart contract implementation for RobotCoin RBTC, a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets...

Security feature bypass

A security flaw in the 'owned' function of a smart contract implementation for RobotCoin RBTC, a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets...

Zero Trust Adoption Report: How does your organization compare?

From the wide adoption of cloud-based services to the proliferation of mobile devices. From the emergence of advanced new cyberthreats to the recent sudden shift to remote work. The last decade has been full of disruptions that have required organizations to adapt and accelerate their security...

maxSumOfPrices check is broken

Handle 0xRajeev Vulnerability details Impact rentAllCards requires the sender to specify a maxSumOfPrices parameter which specifies “limit to the sum of the bids to place” as specified in the Natspec @param comment. This is apparently for front-run protection. However, this function parameter...

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.

...