Malicious early user/attacker can malfunction the contract and even freeze users' funds in edge cases

Handle WatchPug Vulnerability details pointsPerUnit += newXDEFI pointsMultiplier / totalUnitsCached; In the current implementation, pointsPerUnit can be changed in updateDistribution which can be called by anyone. A malicious early user can lock with only 1 wei of XDEFI and makes pointsPerUnit to...

Stack overflow

There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to device cannot be used properly...

MovingAverage.setSampleMemory() may broke MovingAverage, making the value of exchangeRate in StabilizerNode.stabilize() being extremely wrong

Handle WatchPug Vulnerability details function setSampleMemoryuint256 sampleMemory external onlyRoleADMINROLE, "Must have admin privs" requiresampleMemory 0, "Cannot have sample memroy of 0"; if sampleMemory sampleMemory for uint i = sampleMemory; i sampleMemory; i++ samples.push; counter = count...

Input validation

Improper input validation vulnerability in GOT2000 series GT27 model all versions, GOT2000 series GT25 model all versions, GOT2000 series GT23 model all versions, GOT2000 series GT21 model all versions, GOT SIMPLE series GS21 model all versions, and GT SoftGOT2000 all versions allows an remote...

CVE-2021-20601

Improper input validation vulnerability in GOT2000 series GT27 model all versions, GOT2000 series GT25 model all versions, GOT2000 series GT23 model all versions, GOT2000 series GT21 model all versions, GOT SIMPLE series GS21 model all versions, and GT SoftGOT2000 all versions allows an remote...

CVE-2021-20601

The CVE-2021-20601 issue affects Mitsubishi Electric GOT family HMI products: GT27/GT25/GT23/GT21 (GOT2000 series), GS21 (GOT SIMPLE), and GT SoftGOT2000. The vulnerability arises from improper input validation, allowing a remote unauthenticated attacker to write a value beyond the configured inp...

Fee double counting for underwater positions

Handle hyh Vulnerability details Impact Actual available fees are less than recorded. That's because a part of them corresponds to underwater positions, and will not have the correct amount stored with the contract: when calculation happens the fee is recorded first, then there is a check for...

Missing _token.approve() to curvePool in setZapConfig

Handle WatchPug Vulnerability details function setZapConfig uint256 idx, address sett, address token, address curvePool, address withdrawToken, int128 withdrawTokenIndex external onlyGovernance; requiresett != address0; requiretoken != address0; require withdrawToken == addressWBTC || withdrawTok...

Basket.sol#mint() Malfunction due to extra nonReentrant modifier

Handle WatchPug Vulnerability details function mintuint256 amount public nonReentrant override mintToamount, msg.sender; function mintTouint256 amount, address to public nonReentrant override requireauction.auctionOngoing == false; The mint method is malfunction because of the extra nonReentrant...

ConcentratedLiquidityPool.burn() Wrong implementation

Handle WatchPug Vulnerability details The reserves should be updated once LP tokens are burned to match the actual total bento shares hold by the pool. However, the current implementation only updated reserves with the fees subtracted. Makes the reserve0 and reserve1 smaller than the current...

MGASA-2021-0411 Updated gpsd packages fix security vulnerability and other bugs

It was discovered that GPSd incorrectly handled certain leap second events which would result in the time jumping back 1024 weeks on 2021-10-31. This update provides upstream version 3.23 that has this and several other upstream issues fixed. It also fixes issues that prevents it to start properl...

The vulnerability of the Modbus protocol implementation in microprogrammed software for programmable logic controllers like Modicon Quantum arises from incorrect code generation. This allows attackers to trigger malfunctions during maintenance operations.

The vulnerability of the Modbus protocol implementation in microprogrammed software for programmable logic controllers like Modicon Quantum is related to incorrect code generation. Exploiting this vulnerability could allow an attacker, operating remotely, to cause malfunctions in the system’s...

Gateway / AAA : Page stuck at loading (Page Spinning ) after upgrade.

After upgrade when accessing the Citrix Gateway the page is stuck at spinning wheel...

3Dconnexions Spacemouse Enterprise Display not working

When redirected using generic USB feature, 3DConnexions Spacemouse Enterprise: https://3dconnexion.com/de/product/spacemouse-enterprise is not 100% functional. TheVDA detects the device and the mouse joystick is working fine, But the screen on the device stays in the splash screen, instead...

GHSA-58QP-5328-V7MH cumulative-distribution-function Infinite Loop vulnerability

Impact Apps using this library on improper data may crash or go into an infinite-loop In the case of a nodejs server-app using this library to act on invalid non-numeric data, the nodejs server may crash. This may affect other users of this server and/or require the server to be rebooted for prop...

Malicious Package

Overview All versions of http-proxy-middelware contain malicious code. The index.js file attempts to download a file from a remote server and execute it. The file is not run upon installation - the package needs to be required or the index.js run manually. The package contains a typo in its code...

Denial of Service Vulnerability in XINJE XL5E-16T

The XINJE XL5E-16T PLC Unit is a controller product of the Ethernet type series. A denial of service vulnerability exists in the XINJE XL5E-16T. An attacker can exploit this vulnerability to cause the device to not function properly...

Huawei smartphone data forgery issue vulnerability

Huawei Emui is an Android-based mobile operating system from China's Huawei Corporation.Honor Magic Ui is an Android-based mobile operating system from China's Honor Corporation. Huawei smartphones are vulnerable to a data forgery issue, successful exploitation of this vulnerability may result in...

SQLite report about CVE-2021-20223

The problem identified by this CVE is not a vulnerability. It is a malfunction. A coding error causes FTS5 to sometimes return inconsistent and incorrect results under obscure circumstances, but no memory errors occur. details...

SSL VPN : Intranet Applications connectivity break on port 3389 and port 22 after upgrade

After Update to 64.35 the SSL Client send TCP FIN ACK to the Server. This problem is not reported on 13.0.58.32, 13.0.61.48. There is no issue with accessing the Intranet Applications. 13.0.64.35, and 13.0.67.39, the connectivity to port 3389 and port 22 breaks...