drawCoolDownPeriod of 0 may allow frontrunning the draw with a winning ticket purchase

Lines of code Vulnerability details Impact Frontiness rather than luck may determine the winner. Proof of Concept drawCoolDownPeriod may be set to 0. Then a ticket may be bought in the same block as the draw. This allows for frontrunning the randomly selected winning ticket with a ticket purchase...

Lottery owner can manipulate the RNG to favour themselves, or other certain participants

Lines of code Vulnerability details The docs state that Chainlink VRF will be used as the source of randomness, whose subscription model is described here. A call is made to Chainlink's VRFCoordinatorV2 requestRandomWords function, after which a response is sent back in the form of a call to...

Upgraded Q -> 2 from #298 [1677237168746]

Judge has assessed an item in Issue 298 as 2 risk. The relevant finding follows: 01 MALICIOUS USER, WHO OWNS SPLITTABLE FUNDS, CAN CALL DripsHub.setSplits FUNCTION TO FRONTRUN OTHER USER'S DripsHub.split FUNCTION CALL, WHICH CAN BREAK AGREEMENT BETWEEN THESE USERS Based on the current...

Mitigation of M-05: Issue not fully mitigated

Lines of code Vulnerability details Original issue: M-05: early user can call issue and then melt to increase basketsNeeded to supply ratio to its maximum value and then melt won't work and contract contract features like issue won't work Not mitigated - attacker can still manipulate the...

Attacker can temporary deplete available redemption/issuance by running issuance then redemption or vice versa

Lines of code Vulnerability details Impact Attacker can deplete available issuance or redemption by first issuing and then redeeming in the same tx or vice versa. The available redemption/issuance will eventually grow back, but this temporary reduces the available amount. This can also use to fro...

Attacker can cause loss to rToken holders and stakers by running BackingManager._manageTokens before rewards are claimed

Lines of code Vulnerability details Impact The assets that back the rTokens are held by the BackingManager and can earn rewards. The rewards can be claimed via the TradingP1.claimRewards and TradingP1.claimRewardsSingle function. The BackingManager inherits from TradingP1 and therefore the above...

SUSE CVE-2015-7713

OpenStack Compute Nova before 2014.2.4 juno and 2015.1.x before 2015.1.2 kilo do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made...

SUSE CVE-2018-11490

The DGifDecompressLine function in dgiflib.c in GIFLIB possibly version 3.0.x, as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain "Private-RunningCode - 2" array index is not checked. This will lead to a denial of service or possibly unspecified other...

SUSE CVE-2018-11797

In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree...

SUSE CVE-2019-15616

Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long...

SUSE CVE-2020-12912

A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit RAPL interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access...

Upgraded Q -> 2 from #510 [1675932817801]

Judge has assessed an item in Issue 510 as 2 risk. The relevant finding follows: If the current state is Withdrawable, you can still call createMinipool This will result in: 1:recreateMinipool can be front-run by executing recordStakingEnd to get back the stake first, and then executing...

Missing owner check in function addTemplate in DeploymentController

Lines of code Vulnerability details Impact Attacker can add malicous Vaults/Adatpors/Strategies template to TemplateRegistry. Attack can frontrun operator's transaction with the same templateCategory and templateId, but with a malicious Vault/Adatpor/Strategy template. If the operator does not...

Inflation attacks with virtual shares and assets

Lines of code Vulnerability details Impact When the BaseAdapter is empty. Someone can frontrun a user to steal his funds by an inflation attack. Senario Lets say Alice wants to deposit 1 token with decimal 18, so 1e18 units to the vault calling deposit. This is how the attack would unfold. The...

Attacker can steal subprotocol NFT from user who use mint and add

Lines of code Vulnerability details Impact CidNFT.mintbytes allow user to mint and add subprotocol NFTs directly after minting. The addList args to the add call include the cidNFTID param, which can change if there are other mint before the user's transaction. Additionally, CidNFT.add only check ...

DOS mint and add by frontrunning

Lines of code Vulnerability details Impact CidNFT.mintbytes allow user to mint and add subprotocol NFTs directly after minting. The addList args to the add call include the cidNFTID param, which can change if there are other mint before the user's transaction. Proof of Concept An attacker can DOS...

Exploit for Improper Input Validation in Cisco Ios

Cisco-Smart-Exploit Cisco SmartInstall Exploit CVE-2018-0171...

refundETH has no access control and be called repeatedly or Can be Front runned to steal WETH funds from Contract

Lines of code Vulnerability details Impact The function refundETH has no access control and called be called anyone resulting in a loss of WETH funds if address0 is entered as the recipient for removeLiquidity Proof of Concept Consider the scenario if bob calls removeliquidity which returns WETH...

nemo-appium vulnerable to OS Command Injection

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. Note: In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies...

GHSA-C6RX-GXQV-VR5J nemo-appium vulnerable to OS Command Injection

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. Note: In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies...