if user send uninitialized poolId to function deposit() of PermissionlessBasicPoolFactory, then attacker can cause user fund to be locked forever, and only unlock it if user pays ransom

Lines of code Vulnerability details Impact Function deposit of PermissionlessBasicPoolFactory supposed to revert if user send uninitialized poolId by mistake, but if user does this, attacker can perform front-running attack and create multiple pools with his smart contract and be owner of that...

steal user funds with front-running when he calls depositTokens() of MerkleVesting and MerkleResistor with wrong treeIndex (uninitiated)

Lines of code Vulnerability details Impact This nature of this bug is similar in MerkleVesting and MerkleResistor and MerkleDropFactory, so I only write MerkleDropFactory version: If a user calls depositTokens with wrong treeIndex value by mistake, attacker can perform front-running attack and...

An attacker can make users' funds get "locked" in the contract (the owner can get them out and transfer them back to the users)

Lines of code Vulnerability details Impact If a user manages to be the first user to deposit into the contract, he will be minted shares and he can steal all the other users' deposits. Proof of Concept 1. The attacker deposits 1 token into the contract and 1 share is minted to him totalSupply and...

Reentrancy attack in collateral.transferFrom that borrowers can trick lenders to lend but the lenders will never get the collateral

Lines of code Vulnerability details Impact A borrower attacker can use reentrancy attack to request a loan successfully and the collateral is still owned by the attacker. If a lender victim tries to call lend on the malicious loan which seems normal, the lender will lose money and never get the...

Params.oracle can be changed to a fake one by front running NFTPairWithOracle's lend function

Lines of code Vulnerability details Impact As neither lend, nor updateLoanParams functions verify params.oracle, the lend call can be front run by a malicious borrower with changing params.oracle to a non-market one. The front run will be an updateLoanParams call where borrower introduces fake...

An attacker can make users' funds get "locked" in the contract (the owner can get them out and transfer them back to the users)

Lines of code Vulnerability details Impact If a user manages to be the first user to deposit into the contract, he will be minted shares and he can steal all the other users' deposits. Proof of Concept 1. The attacker deposits 1 token into the contract and 1 share is minted to him totalSupply and...

Important: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Veeam Backup & Replication installer fails to launch with the error: "Only one instance of Veeam Backup & Replication Setup is allowed."

Challenge When attempting to launch the Veeam Backup & Replication installer, the following error occurs: Only one instance of Veeam Backup & Replication Setup is allowed. Copy Cause Another instance of the Veeam Backup & Replication Setup.exe is already running. Solution Open Task Manager and...

Index mint and burn calls can be front run

Lines of code Vulnerability details Impact Both in the mint and burn cases all the user supplied / due to a user assets can be stolen by an attacker, who detects correspondingly asset transfer calls / Index token transfer call and front runs Index contract's mint / burn call with own address as a...

Lender can stop others from offering higher rates.

Lines of code NFTLoandFacilitator.lend; L205 Vulnerability details Impact A lender using an upgradeable smart contract could stop other lenders from buying him out, essentially causing a DoS. Proof of Concept Lender uses an upgradeable smart contract that front runs competing lenders and upgrades...

Malicious owner can steal some funds from borrower

Lines of code Vulnerability details Impact Owner can make changes to the protocol with immediate effect. Malicious owner can watch for big lend in the mempool and front run it by maxing out originationFeeRate to 5%. The users, both lender and borrower, will still think that originationFeeRate is...

DoS: User's May Claim _splitId Causing Other Transactions to Revert

Lines of code Vulnerability details Impact Users may set splitId to any value when calling SplitFactory.createSplit allowing the user to claim this ID. This is exploitable to front-running in a denial of service attack where an attacker may call see a transaction in the mempool and call...

Changing a token buy price during the sale by front-running buyers by forcing them to purchase at an unfair token price

This issue has been created to subdivide a multi-part submission to a single, medium severity finding. See issue 50 and in particular, judge @0xleastwood's comment here. --- The text was updated successfully, but these errors were encountered: All reactions...

cscreen 安全漏洞

cscreen is an open source tool. Allows multiple consoles to be run in a single screen session. Ideal for monitoring and logging all serial consoles in a data center in a single screen instance. A security vulnerability exists in cscreen that allows any local user to gain access to the tty and...

CVE-2022-21946

A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory...

The pay() function can still be DOSed

Lines of code Vulnerability details Impact From the prior contest: in the pay function users repay their debt and in line 364: it decreases their debt. lets say a user wants to repay all his debt, he calls the pay function with his full debt. an attacker can see it and frontrun to repay a single...

Exploit for Code Injection in Vmware Spring_Cloud_Gateway

Spring Cloud Gateway RCE Env CVE-2022-22947 CVE-2022-2294...

An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-dbus daemon running an unprivileged user could make USBGuard allow all USB devices to be connected in the future.

...

Miners Can Manipulate tx.gasprice to Drain Users' Wallets in postIncomingMessages()

Lines of code Vulnerability details Impact The postIncomingMessages function is used to broadcast signed data indicating that a funds on an schain will be moved to mainnet. While the function performs proper signature verification, it doesn't prevent any arbitrary user from frontrunning the...

JetBrains TeamCity Security Bypass Vulnerability

JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Czech Republic. A security vulnerability exists in JetBrains TeamCity, which stems from the product's failure to validate user identities. An unauthenticated attacker could use the vulnerability to...