StaticATokenLM::_claimRewardsOnBehalf: wrong update of _unclaimedRewards[onBehalfOf] if reward > totBal lead to user lose of pending rewards.

Lines of code Vulnerability details Description If for some reason the current contract reward token balance is lower than the rewards meant to be paid to onBehalf address, then this rewards can never be claimed. function claimRewardsOnBehalf address onBehalfOf, address receiver, bool forceUpdate...

Insufficient Authorization Checks in 'SGLLeverage' Contract Functions

Lines of code Vulnerability details Description The 'SGLLeverage' contract contains critical vulnerabilities in multiple functions, including 'multiHopBuyCollateral,' 'multiHopSellCollateral,' 'sellCollateral,' and 'buyCollateral.' These functions lack proper authorization checks, allowing any us...

AirdropBroker.sol#L442 : _participatePhase3 - PHASE_3_AMOUNT_PER_USER should be multiplied by 1e18

Lines of code Vulnerability details Impact Incorrect eligibleAmount is minted to the user. Proof of Concept An eligible user can call the participatePhase3 function and mint the aToken to them. function participatePhase3 bytes calldata data internal returns uint256 oTAPTokenID uint256 tokenID =...

cbETH's fails to check for a depeg since pegPrice is always 1

Lines of code Vulnerability details Whenever refresh is called for a collateral it does a few checks, one of them is to ensure the collateral didn't depge. It does so by calling tryPrice and checking that the returned parameter pegPrice which is supposed to represent the current price of the...

_sendToken in tapiocaz::Balancer::rebalance() not sending native fee will lead to revert

Lines of code Vulnerability details Impact function sendToken address payable oft, uint256 amount, uint16 dstChainId, uint256 slippage, bytes memory data private IERC20Metadata erc20 = IERC20MetadataITapiocaOFToft.erc20; if erc20.balanceOfaddressthis amount revert ExceedsBalance; uint256 srcPoolI...

CurveStableMetapoolCollateral.tryPrice returns a huge but valid high price when the price oracle of pairedToken is timeout

Lines of code Vulnerability details The CurveStableMetapoolCollateral is intended for 2-fiattoken stable metapools. The metapoolToken coin0 is pairedToken and the coin1 is lpToken, e.g. 3CRV. And the config.chainlinkFeed should be set for paired token. Impact The CurveStableMetapoolCollateral.pri...

Reentrancy vulnerability in BaseUSDO._executeModule() function

Lines of code Vulnerability details Impact the success variable in the executeModule function in the BaseUSDO contract is written in both line 366 and line 369. This could potentially lead to a reentrancy vulnerability. In line 366, the success variable is set to true. In line 369, the success...

PT-2023-27942 · WordPress · Wp Ultimate Csv Importer

Name of the Vulnerable Software and Affected Versions: WP Ultimate CSV Importer plugin for WordPress versions up to, and including, 7.9.8 Description: The issue allows authenticated attackers with author-level permissions or above to execute code on the server via the -cus1 parameter, if the...

USN-6168-2: libx11 vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description USN-6168-1 fixed a vulnerability in libx11. This update provides the corresponding update for Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 ESM. Original advisory details:...

Cargo not respecting umask when extracting crate archives

The Rust Security Response WG was notified that Cargo did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed b...

CISA, NSA, FBI, and International Partners Release Joint CSA on Top Routinely Exploited Vulnerabilities of 2022 

The U.S. Cybersecurity and Infrastructure Security Agency CISA, National Security Agency NSA, Federal Bureau of Investigation FBI, and international partners are releasing a joint Cybersecurity Advisory CSA, 2022 Top Routinely Exploited Vulnerabilities. This advisory provides details on the top...

CurveVolatileCollateral._underlyingRefPerTok() Possible manipulation

Lines of code Vulnerability details Impact curvePool.getvirtualprice May be manipulated to cause malicious entry DISABLED Proof of Concept CurveVolatileCollateral.underlyingRefPerTok return curvePool.getvirtualprice function underlyingRefPerTok internal view virtual override returns uint192 @...

StaticATokenLM transfer missing _updateRewards

Lines of code Vulnerability details Impact transfer missing updateRewards,Resulting in the loss of from's reward Proof of Concept StaticATokenLM contains the rewards mechanism, when the balance changes, the global accRewardsPerToken needs to be updated first to calculate the user's rewardsAccrued...

_claimRewardsOnBehalf() User's rewards may be lost

Lines of code Vulnerability details Impact Incorrect determination of maximum rewards, which may lead to loss of user rewards Proof of Concept claimRewardsOnBehalf For users to retrieve rewards function claimRewardsOnBehalf address onBehalfOf, address receiver, bool forceUpdate internal if...

ConvexStakingWrapper.sol after shutdown，rewards can be steal

Lines of code Vulnerability details Impact After shutdown, checkpoints are stopped, leading to possible theft of rewards. Proof of Concept ConvexStakingWrapper No more checkpoints after shutdown, i.e. no updates reward.rewardintegralforuser function beforeTokenTransfer address from, address to,...

smart-places.net Cross Site Scripting vulnerability OBB-3566381

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-26449

The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker...

Code injection

The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering...

The Bug Report - July 2023 Edition

The Bug Report – July 2023 Edition By Trellix · August 02, 2023 This story was also written by John Dunlap. A Storm is Brewing! Why am I here? Summer is now in full swing, and our July Bug Report is similarly coming out swinging. This month comes with a red-hot list of software vulnerabilities...

MTE As Implemented, Part 3: The Kernel

By Mark Brand, Project Zero Background In 2018, in the v8.5a version of the ARM architecture, ARM proposed a hardware implementation of tagged memory, referred to as MTE Memory Tagging Extensions. In Part 1 we discussed testing the technical and implementation limitations of MTE on the hardware...