replay attack in StakedUSDe's redistributeLockedAmount function

Lines of code Vulnerability details Impact The vulnerability in the redistributeLockedAmount function of the StakedUSDe contract allows an admin user to redistribute tokens from a restricted address to another address. However, if a user let's call them User A is removed from the blacklist and...

vesting amount is overwritten when rewards are transferred consecutively before a user redeems thereby increasing/decreasing the totalAssets value than it actually should be

Lines of code Vulnerability details Impact In StakedUSDe there is a special rewarder role that can transfer additional usde as rewards for users who have staked usde tokens, now consider a scenario where a rewarder transfers 2 usde to the contract and the vesting period of 8 hours pass and the...

Lack of functionality to distribute the yield to the USDe stakers.

Lines of code Vulnerability details Impact User will not get the benefit of the yield which is output of their USDe staking. Outcome of yield is the core feature of staking. we are submitting this as high. Proof of Concept An user who is not black listed is allowed to stake their USDe by calling...

A fully blacklisted user can withdraw their funds

Lines of code Vulnerability details Impact A fully blacklisted user should not have access to any function of the protocol, but it is possible for a user to withdraw their funds right before being blacklisted. A fully blocked user is capable of frontrunning the addToBlacklist call by calling the...

bad Actor can block the operation of mint by creating duplicate order by frunt runing original order

Lines of code Vulnerability details Impact bad Actor can block the operation of mint by creating duplicate order by frunt runing original order So basically the contracts are doing orders by users RFQ to system whether by API or front end. and make the mint process the problem is in the contract...

A WHALE CAN DoS A NORMAL USER FROM MINTING AND REDEEMING THE USDe BY MAKING THE MINT AMOUNT AND REDEEM AMOUNT PER BLOCK, EXCEEDING THE maxMintPerBlock AND maxRedeemPerBlock RESPECTIVELY

Lines of code Vulnerability details Impact The EthenaMinting.mint function and EthenaMinting.redeem function both have defined modifiers belowMaxMintPerBlock and belowMaxRedeemPerBlock to ensure the mint amount per block and redeem amount per block are limited to upper bounds set by the...

jetsafe.de Improper Access Control vulnerability OBB-3768377

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

U.S. Dept Of Defense: Elasticsearch is currently open without authentication on https://██████l

An Elasticsearch instance accessible at https://██████l was found to be open without authentication, exposing data to unauthorized access. The vulnerability allowed listing and extraction of sensitive data stored in the Elasticsearch indexes. To mitigate, authentication and authorization controls...

CVE-2023-45803

A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as POST to GET, as is required by HTTP...

CVE-2023-46752

A data mishandling vulnerability was found in FRRouting. A malformed MPREACHNLRI data can lead to a crash, resulting in a denial of service. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising...

CVE-2023-45142

A memory leak was found in the otelhttp handler of open-telemetry. This flaw allows a remote, unauthenticated attacker to exhaust the server's memory by sending many malicious requests, affecting the availability. Mitigation As a workaround to stop being affected otelhttp.WithFilter can be used...

Security Bulletin: There is a vulnerability in snappy-java used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2023-34455, CVE-2023-34454, CVE-2023-34453)

Summary There is a vulnerability in snappy-java used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2023-34455 DESCRIPTION: snappy-java is vulnerable to a denial of service, caused by the use of an unchecked chunk length in the hasNextChunk...

CVE-2023-46234

A flaw was found in browserify-sign node package. This issue may allow a malicious user to execute a signature forgery attack by not correctly checking cryptographic signatures for DSA data, resulting in a jeopardized environment. Mitigation No current mitigation is yet available for this flaw...

CVE-2023-31582

A flaw was found in Jose4J which allows a malicious user or internal person to erroneously set a low iteration count of 1000 or less to secure the Json Web Token. This could apply to lack of entropy and leave the system less secure. Mitigation No mitigation is currently available for this flaw...

Centralite Pearl Thermostat

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : Centralite Equipment : Pearl Thermostat Vulnerability : Allocation of Resources Without Limits or Throttling 2. RISK EVALUATION Successful exploitation of this...

Patch…later? Safari iLeakage bug not fixed

Apple has released updates for its phones, Macs, iPads, watches, and TV streaming devices, fixing a bunch of security problems. But amid all that activity, one fix is notably absent—there is nothing to address the vulnerability dubbed iLeakage. iLeakage is a side-channel attack that can force the...

Borrower cannot change market capacity (max total supply) after creating a market

Lines of code Vulnerability details Impact As per docs, "Subsequent to launch, base APR and capacities can be adjusted by the borrower at will". After creating a market, a borrower cannot increase the maximum total supply which contradicts the documentation. Proof of Concept The...

ERC20 tokens can be incorrectly burnt because of insufficient validation

Lines of code Vulnerability details Impact ERC20 tokens are incorrectly burnt. Proof of Concept In the file WildcatSanctionsEscrow.sol there is a constructor function: constructor sentinel = msg.sender; borrower, account, asset = WildcatSanctionsSentinelsentinel.tmpEscrowParams; Let's suppose thi...

Denial of service to closeMarket.

Lines of code Vulnerability details Summary No mechanism to close the market. Impact Denial of service to closeMarket. Vulnerability Details Only controller can call closeMarket but there is no implementation to close market in controller. Tools Used Manual Review Recommended Mitigation Steps Add...

closeMarket() can only be called by the market controller but the controller has no function to close a market.

Lines of code Vulnerability details Description Due to the restriction on the closeMarket function, only the controller is able to use it, but the controller contract has no way to call it. Impact Since the borrower becomes unable to close a market once it opened, it becomes a big issue as the...