BIG-IP Access Policy Manager Vulnerable Information Exposure

The vulnerabilities of the BIG-IP Access Policy Manager, as well as of software solutions such as BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Application Visibili...

BIG-IP Session Duration Issue

The vulnerabilities of the BIG-IP Access Policy Manager, as well as of software solutions such as BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Application Visibili...

[SECURITY] Fedora 38 Update: cachelib-17^20231016-1.fc38

CacheLib is a C++ library providing in-process high performance caching mechanism. CacheLib provides a thread safe API to build high throughput, low overhead caching services, with built-in ability to leverage DRAM and SSD caching transparently...

[SECURITY] Fedora 37 Update: cachelib-17^20231016-1.fc37

CacheLib is a C++ library providing in-process high performance caching mechanism. CacheLib provides a thread safe API to build high throughput, low overhead caching services, with built-in ability to leverage DRAM and SSD caching transparently...

Foreman: Arbitrary code execution through templates

An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system...

Foreman: Arbitrary code execution through templates

An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system...

Unauthorized account can update policy of any account without a policy

Lines of code Vulnerability details Impact Unauthorized account can update policy of any account without a policy Proof of Concept if currentCommit == bytes320 && msg.sender == AddressProviderService.getAuthorizedAddressSAFEDEPLOYERHASH The argument passed into getAuthorizedAddress -...

Signed data may be usable cross-chain

Lines of code Vulnerability details Impact The function validatePreTransactionOverridable, which Validates a txn on guard before execution, for Brahma console accounts.takes one parameter "txParams" which is of type SafeTransactionParams Struct, if we look at that struct members : struct...

Nonce is not incremented after using signature for policy validation

Lines of code Vulnerability details Impact Nonce is not incremented after using signature for policy validation Proof of Concept In PolicyValidator.sol there is a function function isPolicySignatureValid address account, address to, uint256 value, bytes memory data, Enum.Operation operation, byte...

attacker can perform malicious transactions in the safe because reentrancy is not implemented in the execTransaction() and checkAfterExecution() function

Lines of code Vulnerability details Impact Due to reentrancy, it's possible to set a guard or threshold during the execTransaction and execute another malicious transaction which resets the guard and threshold Proof of Concept to prevent reentrancy during the safe's execTransaction function code...

Malicious Module can change the policy commit of a Gnosis Safe console Account

Lines of code Vulnerability details Impact The overall design of the Gnosis safe allows for the addition of a Module, modules are smart contracts that extend the ability of the Gnosis safe, which means that a module can be setup in such a way that it can perform actions that is meant to improve t...

Executor can effectively bypass _checkSubAccountSecurityConfig by adding a new Module

Lines of code Vulnerability details Impact An Executor is an account authorized to perform module execution on a subAccount through the ExecutorPlugin. Gnosis Safe Modules manage to bypass the entire guard logic Safe 1.5 has that new guard hook, but there's also no hook logic done in Brahma. For...

SafeDeployer : calling the function _genNonce would overflow.

Lines of code Vulnerability details Impact Genosis safe account can not be created due to overflow of genNonce Proof of Concept The contract SafeDeployer deploy the Genosys safe account. To this, there are set of function which accomplish this task. First the function deployConsoleAccount will be...

The same console addresses on other chains can be captured by compromised or malicious owner

Lines of code Vulnerability details Impact The same order of owners addresses lets generate the same console address on all chains. But any owner from the list can deploy console accounts on other chains with threshold parameter equals 1 and then change owners in these accounts, i.e. capture thes...

registerWallet() does not validate the sender

Lines of code Vulnerability details Issue registerWallet in WalletRegistry.sol does not guarantee that the sender is the safe deployer. registerWallet should be called from the safe deployer, in the context of deployConsoleAccount // Register Wallet /// @dev This function is being packed as a par...

getModulesPaginated does not return the correct data

Lines of code Vulnerability details Impact In ConsoleFallbackHandler, you can call getModules to return the first 10 modules: function getModules external view returns address memory GnosisSafe safe = GnosisSafepayablemsg.sender; address memory array, = safe.getModulesPaginatedSENTINELMODULES, 10...

Lack of Input Validation on threshold and _owners

Lines of code Vulnerability details Impact Unvalidated inputs can lead to unexpected contract behaviors, including but not limited to, incorrect configurations, locked funds, or erroneous operations. In extreme cases, it could also lead to security vulnerabilities if malicious actors can exploit...

Cross-Chain Signature Replay Attack

Lines of code Vulnerability details Impact 1. User operations can be replayed on smart accounts accross different chains. This can lead to user's loosing funds or any unexpected behaviour that transaction replay attacks usually lead to. 2. Mistakes made on one chain can be re-applied to a new...

CVE-2023-28373

A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode...

CVE-2023-32572

A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection...