40 matches found
TokenisableRange.sol claimFee function allows more slippage than intended due to incorrect calculation
Lines of code Vulnerability details Impact In TokenisableRange.sol, claimFee collects swap fees generated in uniswap and compound these fees by minting to Uniswap pool. During minting collected fees back in uniswap, slippage protection is conducted by comparing addedValue - a value based on added...
RTokenAsset price estimation accounts for margin of error twice
Lines of code Vulnerability details RTokenAsset estimates the price by multiplying the BU basket unit price estimation by the estimation of baskets held then dividing by total supply. The issue is that both BU and baskets held account for price margin of error, widening the range of the price mor...
Not enough margin pulled or burned from user when adding to a position
Lines of code Vulnerability details Impact When adding to a position, the amount of margin pulled from the user is not as much as it should be, which leaks value from the protocol and lowering the collateralization ratio of tigAsset. Proof of Concept In Trading.addToPosition the handleDeposit...
Top MSSP CEOs Share 7 Must-Do Tips for Higher MSSP Revenue and Margin
MSSPs must find ways to balance the need to please existing customers, add new ones, and deliver high-margin services against their internal budget constraints and the need to maintain high employee morale. In an environment where there are thousands of potential alerts each day and cyberattacks...
WP Social Buttons <= 2.2 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Put the following payload in the Delay Time General Settings or Top Margin Advanced Settings of the...
CVE-2021-44840
An issue was discovered in Delta RM 1.2. Using an privileged account, it is possible to edit, create, and delete risk labels, such as Criticality and Priority Indication labels. By using the /core/table/query endpoint, and by using a POST request and indicating the affected label with tableUid...
withdrawTo Does Not Sync Before Checking A Position's Margin Requirements
Handle leastwood Vulnerability details Impact The maintenanceInvariant modifier in Collateral aims to check if a user meets the margin requirements to withdraw collateral by checking its current and next maintenance. maintenanceInvariant inevitably calls AccountPosition.maintenance which uses the...
No bound on marginRewardRate
Handle gzeon Vulnerability details Impact There is no check when setting marginRewardRate, if it is set to any value FixedPoint.ONE i.e. 1e18 it would lead to underflow at L403 Proof of Concept Recommended Mitigation Steps Add related check in setMarketInfo --- The text was updated successfully,...
OverlayV1Mothership.sol Incomplete implementation
Handle WatchPug Vulnerability details Based on the context, FEE and MARGINMAINTENANCE rates should be bounded. However, the current implementation does not enforce these bounds. uint16 public constant MINFEE = 1; // 0.01% uint16 public constant MAXFEE = 100; // 1.00% uint16 public constant...
Rewards cannot be withdrawn
Email address [email protected] Handle @cmichelio Eth address 0x6823636c2462cfdcD8d33fE53fBCD0EdbE2752ad Vulnerability details The rewards for a recipient in IncentiveDistribution.sol are stored in the storage mapping indexed by recipient accruedRewardrecipient and the recipient is the actual margi...
Isolated margin contracts declare but do not set the value of liquidationThresholdPercent
Email address [email protected] Handle paulius.eth Eth address 0x523B5b2Cc58A818667C22c862930B141f85d49DD Vulnerability details CrossMarginTrading sets value of liquidationThresholdPercent in the constructor: liquidationThresholdPercent = 110; Isolated margin contracts declare but do not set the...
No default liquidationThresholdPercent
Email address [email protected] Handle @cmichelio Eth address 0x6823636c2462cfdcD8d33fE53fBCD0EdbE2752ad Vulnerability details The IsolatedMarginTrading contract does not define a default liquidationThresholdPercent which means it is set to 0. The belowMaintenanceThreshold function uses this value...
AutoDesk AutoCAD 2019 cell margin code execution vulnerability
Summary An exploitable heap overflow vulnerability exists in the DXF-parsing functionality of AutoDesk AutoCAD 2019 P.46.0.0. A specially crafted DXF file with too many cell margins populating an AcCellMargin object can cause a heap overflow, resulting in code execution. An attacker can provide a...
Adobe Flash - Margin Handling Heap Corruption Exploit
Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1174 The attached fuzzed swf causes a crash due to heap corruption when processing the margins of a rich text field. Proof of Concept:...
Adobe Flash - Margin Handling Heap Corruption
Adobe Flash - Margin Handling Heap Corruption Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1174 The attached fuzzed swf causes a crash due to heap corruption when processing the margins of a rich text field. Proof of Concept:...
Adobe Flash - Margin Handling Heap Corruption
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1174 The attached fuzzed swf causes a crash due to heap corruption when processing the margins of a rich text field. Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42018.zip...
New Attack Against AES-256 a 'Huge Result'
A group of cryptographers has devised a new attack against AES, the de facto standard encryption algorithm, that enables them to recover an encryption key in far less time than had been possible before. The attack can recover an AES-256 key in a small enough amount of time to make the method...
Debian Security Advisory DSA 140-2 (libpng, libpng3)
The remote host is missing an update to libpng, libpng3 announced via advisory DSA 140-2. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
Debian DSA-140-2 : libpng - buffer overflow
Developers of the PNG library have fixed a buffer overflow in the progressive reader when the PNG datastream contains more IDAT data than indicated by the IHDR chunk. Such deliberately malformed datastreams would crash applications which could potentially allow an attacker to execute malicious...
