75 matches found
Usage of insecure transfer/transferFrom
Lines of code Vulnerability details Proof of Concept This is a well known issue, the protocol uses at many parts the insecure transfer/safeTransfer for generic ERC20 tokens. Recommended Mitigation Steps Use OZ Safe Transfer --- The text was updated successfully, but these errors were encountered:...
Fake orders can be created for non existant tokens
Lines of code Vulnerability details Impact NFT's can be stolen by an attacker Proof of Concept The putty contract is using the solmate safeTransfer instead of OpenZeppelin's so contract existence isn't being checked for transferred tokens. In the putty case, contract existance is checked for the...
MAL-2022-5166 Malicious code in oz-select-lib2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc244268e31ff162335d149980a9cd27488d212971b485bfe356426e18ec7067 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in oz-select-lib2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc244268e31ff162335d149980a9cd27488d212971b485bfe356426e18ec7067 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in oz-player (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccd4984750ccb8433c4991e79a495781812915018bdcda89aca6be12fa2928a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5165 Malicious code in oz-player (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccd4984750ccb8433c4991e79a495781812915018bdcda89aca6be12fa2928a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Non-standard ERC20 Tokens are Not Supported
Lines of code Vulnerability details When trying to call SuperVault.executeOperation the transaction reverts. This is because the call to asset.approve in line97 doesn't match the expected function signature of approve on the target contract like in the case of USDT. This issue exists in any call ...
Users' tokens can be stuck inside LaunchEvent if the token doesn't revert on failed transfers
Handle UncleGrandpa925 Vulnerability details Impact Users' tokens can be stuck inside LaunchEvent if the token doesn't revert on failed transfers. Issue When users call withdrawIncentives, if for any reasons the token transfer fails & the token doesn't revert but only returns a boolean, the user'...
Potential Reentrancy at multiple places
Handle 0v3rf10w Vulnerability details Impact Potential Reentrancy at multiple places Proof of Concept L2Migrator.finalizeMigrateDelegatorIMigrator.MigrateDelegatorParams contracts/L2/gateway/L2Migrator.sol130-188: L1Escrow.approveaddress,address,uint256 contracts/L1/escrow/L1Escrow.sol21-28...
unchecked return value from transfer()
Handle JMukesh Vulnerability details Impact transfer does not check the return , due which transfer may get failed without reverting . some tokens does not revert on failure , they just return false Proof of Concept Tools Used manual review Recommended Mitigation Steps use safetransferFrom from o...
OZ ERC1155Supply vulnerability
Handle pauliax Vulnerability details Impact Overlay uses OZ contracts version 4.3.2: dependencies: - OpenZeppelin/[email protected] and has a contract that inherits from ERC1155Supply: contract OverlayV1OVLCollateral is ERC1155Supply This version has a recently discovered vulnerability...
oz-school.ru Cross Site Scripting vulnerability OBB-1321183
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Web Ofisi Firma 13 - (oz) SQL Injection Vulnerability
Exploit for linux platform in category web applications Exploit Title: Web Ofisi Firma 13 - 'oz' SQL Injection Date: 2019-07-19 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/kurumsal-firma-v13-sinirsiz-dil.html Demo Site: http://demobul.net/firmav13/ Version: v13 Teste...
Rockwell Automation 1771-OZ or 1771-OZL General Purpose Discrete I/O
Binary data 753429.prm...
The Wizard Of Oz - WebView SSL handling enabled, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application The Wizard Of Oz published at the 'play' market has multiple vulnerabilities...
Wizard of Oz Free Slots Casino - Customized SSL, Redefined SSL Common Names verifier, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Wizard of Oz Free Slots Casino published at the 'play' market has multiple vulnerabilities...
Ostsee-Zeitung - OZ Mobil - Customized SSL, MIT license, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Ostsee-Zeitung - OZ Mobil published at the 'play' market has multiple vulnerabilities...
DLA-273-1 tidy - security update
Bulletin has no description...
PT-2015-6384 · Linux +3 · Linux Kernel +3
Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 4.0.5 Description: The issue allows remote attackers to cause a denial of service, resulting in a system crash due to a divide-by-zero error, via a crafted packet. This is caused by a problem in the oz usb handle...
PT-2015-6383 · Linux +3 · Linux Kernel +3
Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 4.0.5 Description: The issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted packet, related to the oz usb rx and oz usb handle ep data functions. This is due...