CVE-2020-2719

Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications component: Core. Supported versions that are affected are 12.3.0-12.4.0 and 14.0.0-14.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

Malicious code in sui-lending-protocol (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e6570f41c53bce293ad4b3bea99d8f2ed4c76e5fb5208785bdaf221dcfbe5d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2528 Malicious code in sui-lending-protocol (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e6570f41c53bce293ad4b3bea99d8f2ed4c76e5fb5208785bdaf221dcfbe5d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Predatory app downloaded 100,000 times from Google Play Store steals data, uses it for blackmail

A malicious app claiming to be a financial management tool has been downloaded 100,000 times from the Google Play Store. The app— known as “Finance Simplified”—belongs to the SpyLoan family which specializes in predatory lending. Sometimes malware creators manage to get their apps listed in the...

CVE-2020-2718

Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications component: Core. Supported versions that are affected are 12.3.0-12.4.0 and 14.0.0-14.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

python_book 安全漏洞

pythonbook is an online book lending website, book management system by Tim Green, an individual developer. A security vulnerability exists in pythonbook V1.0, which is caused by an arbitrary file upload vulnerability in the user avatar upload function...

Malicious code in lending-vault (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 133b0e4cf25dec04c7c3fb38e07d7d25d2b2cde44a6c4539d991144baa073ec7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9097 Malicious code in lending-vault (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 133b0e4cf25dec04c7c3fb38e07d7d25d2b2cde44a6c4539d991144baa073ec7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

update_market() market weight incorrect

Lines of code Vulnerability details Vulnerability details in updatemarket We need to get the weight percentage of the corresponding market epoch through gaugeController Then allocate cantoPerBlockepoch according to the percentage The main logic code is as follows: function updatemarketaddress...

secRewardsPerShare Insufficient precision

Lines of code Vulnerability details Vulnerability details we also introduced the field secRewardDebt. The idea of this field is to enable any lending platforms that are integrated with Neofinance Coordinator to send their own rewards based on this value or rather the difference of this value sinc...

Attacker can extract value from pool by sandwiching herself at swapAll during close

Lines of code Vulnerability details Attacker can drain the lending pool by leveraging two facts: 1. swapAll allows 1% slippage 2. There is no Health Factor check after close. Alice and Bob are good friends, the steps are in one single tx: 1. Alice deposits 10000 USDT and borrows 7000$ worth of TR...

No need to stack lend pool to take lendlaunger rewards

Lines of code Vulnerability details Impact Lending lenger give reward tokens to users if they lend their tokens to selected pools. Lendingledger give rewards as weekly and it records user's balance until end of the weekespacially thursday because 1 jan 1970 was thursday. But protocol records can ...

receive function allows any user to lose funds

Lines of code Vulnerability details Impact Lending ledger receive function allows for any user to send funds and lose them forever. Proof of Concept Any user that sends funds to the Lending Ledger contract through the receive function, can't withdraw their funds meaning they would be stuck in...

User can claim most of the rewards for a lending market by depositing cNote for just 2 blocks / epoch

Lines of code Vulnerability details Impact For a user to receive rewards for supplying cNote in a lending market LM, he only needs to have supplied the cNote at the end of an epoch. Users staking for the whole duration of an epoch get 0 benefits, compared to users who supply only at the end of th...

Threatening rogue finance apps removed from the Apple Store

Multiple apps have been removed from the App Store in India after a large helping of unethical behaviour was aimed at their users. TechCrunch reports that "Pocket Kash, White Kash, Golden Kash, and OK Rupee" among others were taken down after getting close to the top 20 finance app listing spots...

Inexistent Slippage Evaluation

Lines of code Vulnerability details Impact The ecosystem of Ethos Reserve contains an EIP-4626 implementation of a vault meant to be integrated by its LUSD lending and borrowing system. As per the standard's Security Considerations itself, slippage checks need to be introduced at the integration...

Multiple addresses can point to the same cidNFTID

Lines of code Vulnerability details Impact During AddressRegistry.register there is no check to ensure that a cidNFTID has been registered to an address. As CID NFT is transferrable, this means that the same CID NFT can be registered by multiple addresses. This could cause troubles for Dapps that...

totalCollateralValue in maxDebt may not be calculated correctly everytime

Lines of code Vulnerability details Impact totalCollateralValue in maxDebt may not be calculated correctly sometimes which leads to questionable lending procedures. Proof of Concept Bob has 10 BAYC NFTs, one of which is an extremely rare one with a crown and a rainbow body, which costs about 150...

Attackers can obtain rewards through the NFT of the flash loan winning ID

Lines of code Vulnerability details Impact The contract judges whether the user has won a prize, but only judges whether the owner of the nft with the specified ID is equal to the user's address user == IERC721EnumerableUpgradeablesettings.drawingToken.ownerOf request.currentChosenTokenId ; But i...

Android Malware Campaign Leverages Money-Lending Apps to Blackmail Victims

A previously undocumented Android malware campaign has been observed leveraging money-lending apps to blackmail victims into paying up with personal information stolen from their devices. Mobile security company Zimperium dubbed the activity MoneyMonger, pointing out the use of the cross-platform...