Lack of Limit on amount Allows Borrowers To Be Extorted For Interest Payments

Lines of code Vulnerability details Impact There is on limit on the upper bounds on the amount a lender may send to a borrower. Borrowers will then be forced to pay interest and facilitators fee on the full amount loaned. The impact for a borrower is that they may be forced to repay significantly...

Borrower collateral can be stolen

Lines of code Vulnerability details Impact In case of collateral price fluctuation, lender can create a situation where borrower would be unable to repay the loan and lender could get hold of collateral Proof of Concept 1. User creates a loan request for duration 1 day and minimum amount as 0.1...

Missing allowlist checks on tokens in CrossAnchorBridge could cause loss of funds

Lines of code Vulnerability details Impact The CrossAnchorBridge contract accepts any ERC20 token and transfers them to the wormhole bridge. There were allowlist checks on the tokens before, but they were commented out in this version for the audit. If a user transfers, for example, non-supported...

Cannot use most piecewise linear functions with current implementation

Handle cmichel Vulnerability details The ThreePieceWiseLinearPriceCurve.adjustParams function uses three functions f1, f2, f3 where yi = fixi. It computes the y-axis intersect b2 = f20, b3 = f30 for each of these but uses unsigned integers for this, which means these values cannot become negative...

Lending Pair initialize function can be front run.

Handle jonah1005 Vulnerability details Impact LendingPair does not initialize tokenMaster, controller, tokens. A hacker can listen the deployer address and front run the initialize transaction. The initialized contract would look almost exactly the same if the hacker only replace lpTokenMaster wi...

Griefing lenders

Handle gpersoon Vulnerability details Impact Suppose there are several lenders for token B of a pair. And an attacker puts in a deposit for token A to the maximum possible amount via accountA. And an attacker puts in a deposit for token B to the maximum possible amount via accountB. And then lend...

Incorrect AsymmetricShare calculation in Utils.sol

Handle 0xRajeev Vulnerability details Impact The calcAsymmetricShare function is supposed to calculate the numerator as: share = u U 2 A^2 - 2 U u + U^2/U^3 which can be considered as part1 part2 - part3 + part4 / part5 according to the code comments. However the formula for part1, part2 and part...

Stable Yield Credit Security Breach

Stable Yield Credit is a new protocol for decentralized lending, stablecoin, and automated market maker AMM in one for the Stable Yield Credit community. Stable Yield Credit suffers from a security vulnerability that stems from certain miscalculations in the deposit function. An attacker could...

SQL Injection Vulnerability in elib, the Book Lending Management System of Qixing Company (CNVD-2020-73421)

Qixing book lending system is a book lending management system, including the front and back office management system, the system uses ASP.NET language development. There is a SQL injection vulnerability in elib, which can be exploited by attackers to obtain sensitive information from the databas...

SQL Injection Vulnerability in elib, the Book Lending Management System of Qixing Company (CNVD-2020-72445)

Qixing book lending system is a book lending management system, including the front and back office management system, the system uses ASP.NET language development. There is a SQL injection vulnerability in elib, which can be exploited by attackers to obtain sensitive information from the databas...

SQL Injection Vulnerability in elib, the Book Lending Management System of Qixing Company (CNVD-2020-72444)

Qixing book lending system is a book lending management system, including the front and back office management system, the system uses ASP.NET language development. There is a SQL injection vulnerability in elib, which can be exploited by attackers to obtain sensitive information from the databas...

SQL Injection Vulnerability in Qixing Company's Book Lending Management System elib

Qixing Attendance System is a system for book lending management, including front and backend management system, which is developed using ASP.NET language. There is a SQL injection vulnerability in elib, the book lending management system of Qixing Company, which can be exploited by attackers to...

The vulnerability of the Core component of the Oracle Banking Corporate Lending software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Core component of the Oracle Banking Corporate Lending software lies in insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information via the HTTP network protocol...

Oracle Banking Corporate Lending Information Disclosure Vulnerability

Oracle Banking Corporate Lending is a bank loan management component of Oracle Corporation Oracle. An information disclosure vulnerability exists in the Core component of Oracle Banking Corporate Lending versions 12.3.0, 14.0.0 through 14.4.0. An attacker could exploit this vulnerability to gain...

CVE-2020-14894

Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications component: Core. Supported versions that are affected are 12.3.0 and 14.0.0-14.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2020-14894

Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications component: Core. Supported versions that are affected are 12.3.0 and 14.0.0-14.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

Buffer overflow

Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications component: Core. Supported versions that are affected are 12.3.0 and 14.0.0-14.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2020-14894

CVE-2020-14894 affects Oracle Banking Corporate Lending (Core) in Oracle Financial Services Applications. Affects supported versions 12.3.0 and 14.0.0–14.4.0. The vulnerability allows a low-privilege attacker with network access via HTTP to compromise Oracle Banking Corporate Lending, potentially...

Xiamen Ejin Online Financial Information Service Co., Ltd.'s Good Lending Loan King Has Logic Flaw Vulnerabilities

Good Borrower Loan King app is a mobile lending tool developed by Ejin Online. Xiamen Ejin Online Financial Information Service Co., Ltd.'s Good Lending Money Loan King has a logic flaw vulnerability that can be exploited by an attacker to The attacker can take advantage of the loophole to regist...

SQL Injection Vulnerability in Star eBook Platform

Star eBook platform is a comprehensive service platform integrating "copyright management, new book release, eBook purchase, sales, lending and knowledge discovery". A SQL injection vulnerability exists in the eBook Platform, which can be exploited by attackers to obtain sensitive information fro...