GO-2024-3307 CVE-2024-50948 in github.com/mochi-mqtt/server

CVE-2024-50948 in github.com/mochi-mqtt/server...

Mochi MQTT 安全漏洞

Mochi MQTT is a fully compatible, embeddable, high-performance Go MQTT v5 proxy/server from the Mochi MQTT open source. A security vulnerability exists in Mochi MQTT version v2.6.3, which stems from a vulnerability that allows an attacker to trigger a denial of service DoS via a crafted request...

Malicious code in @grubhubprod/mochi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 082e82d92950ed7e74f32c77471c1ff88720343ca31adb94676a844f1dc0a1d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-299 Malicious code in @grubhubprod/mochi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 082e82d92950ed7e74f32c77471c1ff88720343ca31adb94676a844f1dc0a1d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[DutchAuctionLiquidator.sol] The return value of an external transfer call is not checked

Handle nikitastupin Vulnerability details Impact Some tokens do not revert in case of failure and return false instead. If one of these tokens is used in Mochi, settleLiquidation will not revert if the transfer fails, and an attacker can call settleLiquidation for free. Proof of Concept Tools Use...

Improper Validation Of create2 Return Value

Handle leastwood Vulnerability details Impact The BeaconProxyDeployer.deploy function is used to deploy lightweight proxy contracts that act as each asset's vault. The function does not revert properly if there is a failed contract deployment or revert from the create2 opcode as it does not...

MochiProfileV0.registerAsset() Can Reset Existing Asset Classes

Handle leastwood Vulnerability details Impact registerAsset is used to add assets to the Mochi Protocol. These assets have an associated asset class which represents an asset's risk factor. registerAsset can be called by any user and abused in such a way that existing assets can have their...

ERC20 return values not checked

Handle cmichel Vulnerability details The ERC20.transfer and ERC20.transferFrom functions return a boolean value indicating success. This parameter should checked for success. See VestedRewardPool.claim which performs ERC20 transfers without checking for the return value. Impact As the trusted moc...

treasuryShare is Overwritten in FeePoolV0._shareMochi()

Handle leastwood Vulnerability details Impact The FeePoolV0.sol contract accrues fees upon the liquidation of undercollaterised positions. These fees are split between treasury and vMochi contracts. However, when distributeMochi is called to distribute mochi tokens to veCRV holders, both mochiSha...

Tokens Can Be Stolen By Frontrunning VestedRewardPool.vest() and VestedRewardPool.lock()

Handle leastwood Vulnerability details Impact The VestedRewardPool.sol contract is a public facing contract aimed at vesting tokens for a minimum of 90 days before allowing the recipient to withdraw their mochi. The vest function does not utilise safeTransferFrom to ensure that vested tokens are...

ProArcadeScript Cross Site Scripting

Exploit Title: XSS Vulnerability in ProArcadeScript Version: Web Application Vendor:http://proarcadescript.com/ Author: Sid3^effects aKa HaRi Code : Date :27 apr,2010 --------------------------------------------------------------------------------------- XSS Vulnerability in ProArcadeScript Greet...