20418 matches found
H-01 Unmitigated
Lines of code Vulnerability details Mitigation of H-01: Issue NOT mitigated Mitigated issue H-01: Intrinsic arbitrage from price discrepancy The issue was that a price discrepancy between the exchange and oracle could be exploited within AfEth for an arbitrage. Mitigation review The maximum profi...
surplusTransferPercentage will always be less than 1%
Lines of code Vulnerability details Impact The protocol has a feature to auction the surplus amount and send some % out of that to extraSurplusReceiver but currently this % always less than 1% which limits the amount extraSurplusReceiver can get out of the surplus Proof of Concept we believe this...
Lack of Reentrancy guard on auctionSurplus() function
Lines of code Vulnerability details Impact auctionSurplus function have call backs that can lead to reentrancy and manipulating the transfer of tokens. Malicious actor can manipulate token transfer by changing the destination address to himself and get all the extra tokens. Proof of Concept...
CamelotRelayer uses wrong interface for CamelotPair
Lines of code Vulnerability details Impact The CamelotRelayer uses the OracleLibrary as an interface for accessing oracle data from the CamelotPair contract which is the Camelot DEX's equivalent of a pool using the OracleLibrary from UniSwapV3Pool's periphery contracts but because the CamelotPair...
Rounding Bug in OracleLibrary.consult Impacting Pricing Accuracy and User Costs
Lines of code Vulnerability details Impact The rounding bug in the OracleLibrary.consult function has a significant impact on applications that rely on this function for price calculations, especially those involving asset swaps, collateral valuation, or other financial transactions. The bug caus...
M-05 Unmitigated
Lines of code Vulnerability details Mitigation of M-05: Mitigation Error, see comments Link to Issue: code-423n4/2023-09-asymmetry-findings45 Comments To mitigate M-05, the sponsor has added a delay of one epoch when the available CVX balance is enough to cover the withdrawal: 81: uint256...
Broken logical expression in onlyManager()
Lines of code Vulnerability details Original Issue H-05: Functions in the VotiumStrategy contract are susceptible to sandwich attacks Details Depositing/withdrawing directly to/from derivatives provides an opportunity for an adversary to sandwich the users, since the slippage control mechanism wa...
ODProxy is flawed due to delegatecall to ODSafeManager which render system inoperable
Lines of code Vulnerability details Impact The vulnerability arises from the use of delegatecall to interact with the ODSafeManager contract, which is designed to store the context of the safe manager. However, the data inside ODSafeManager is never properly updated when ODProxy uses delegatecall...
Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF
Summary The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery. It is possibl...
WordPress Mediabay Plugin <= 1.6 is vulnerable to Broken Access Control
Software Mediabay Type Plugin Vulnerable versions = 1.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-46612 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 01f288807115 Credits emad Required privilege Subscriber...
PT-2023-29675 · Unknown · Peter'S Custom Anti-Spam
Name of the Vulnerable Software and Affected Versions: Peter Keung Peter’s Custom Anti-Spam plugin versions = 3.2.2 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. No information is provided about the estimated number of potentially affected devic...
PT-2023-29571 · Zzcms · Zzcms
Name of the Vulnerable Software and Affected Versions: zzzCMS version 2.1.9 Description: The issue allows a remote attacker to execute arbitrary code via modification of the imageext parameter from jpg, jpeg, gif, and png to jpg, jpeg, gif, png, pphphp. This enables the attacker to potentially...
CVE-2023-5633
The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user...
Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 6.4.16 and fixes or adds mitigations for atleast the following security issues: A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often...
CVE-2023-4921
A use-after-free flaw was found in qfqdequeue and aggdequeue in net/sched/schqfq.c in the Traffic Control QoS subsystem in the Linux kernel. This issue may allow a local user to crash the system or escalate their privileges on the system. Mitigation Mitigation for this issue is to skip loading th...
Advisory ROSA-SA-2023-2277
software: ffmpeg 4.4.3 OS: ROSA-CHROME packageevrstring: ffmpeg-4.4.3-2.src.rpm CVE-ID: CVE-2022-3109 BDU-ID: 2023-04787 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the vp3decodeframe function of the libavcodec/vp3.c component of the FFmpeg multimedia library is related to a lack of validation o...
PT-2023-7566 · Iterm2 · Iterm2
Name of the Vulnerable Software and Affected Versions: iTerm2 versions prior to 3.4.20 Description: The issue is related to the mishandling of certain escape sequences related to upload, which can allow potentially remote code execution. This is due to a lack of proper output encoding or escaping...
CVE-2023-45677
CVE-2023-45677 affects stb_vorbis used by SDL2_sound/stb_vorbis.c. A crafted file can trigger a heap out-of-bounds write via f->vendor[len] = (char) '\0' with a negative len during start_decoder, and an integer overflow when len is INT_MAX during allocation of f->vendor and comment_list[i]....
ilogistics.ee Cross Site Scripting vulnerability OBB-3757106
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
