stETH/ETH, rETH/ETH and cbETH/ETH chainlink oracles has too long of heartbeat and deviation threshold which can cause loss of funds

Lines of code Vulnerability details ChainlinkPriceOracle fetches prices from the Chainlink contracts. But the price feeds in the consideration has a very long price heartbeat and deviation rate which might lead to wrong price calculation and loss of token to the user. Impact According to the...

HGiga MailSherlock SQL注入漏洞

Hgiga MailSherlock is an enterprise email audit system from China Henderson Technology Hgiga. A SQL injection vulnerability exists in HGiga MailSherlock version 4.5, which stems from a query function that does not adequately validate user input. An attacker can exploit this vulnerability by...

Sherlock: arbRestake() doesnt reduce addressShares of owner

Handle GreyArt Vulnerability details Impact As per the documentation, “After 2 weeks without action on an unlocked position arbs can come in to arbRestakeid, 20% of the underlying USDC amount principal + yield is at risk for the owner of the position.” While shares are redeemed for the arbitrager...

Users shouldn't be forced into a specific strategy (possible rug pull)

Handle harleythedog Vulnerability details Impact As already discussed in the previous Sherlock C4 contest here, it is best to mitigate rug pull possibilities even if the team is well intentioned, there is still the risk of being called out, and less users might interact with the project if the...

Sherlock: Decouple yield strategy with withdrawals

Handle GreyArt Vulnerability details Impact If there are funds remaining in an old strategy, there is only 1 way to claim those funds which is through Sherlock.updateYieldStrategy . It is quite an inconvenience to do this. Recommended Mitigation Steps Create an additional function to allow anyone...

Reenterancy in _sendSherRewardsToOwner()

Handle kirk-baird Vulnerability details Impact This is a reentrancy vulnerability that would allow the attacker to drain the entire SHER balance of the contract. Note: this attack requires gaining control of execution sher.transfer which will depend on the implementation of the SHER token. Contro...

Hardcoded seed phrase in sherlock-v2-core repo

Handle cryptphi Vulnerability details Impact The hardcoded mnemonic can lead to account compromise. Proof of Concept There exists hardcoded credentials in line This credentials can be used to takeover the wallet address used. Tools Used Github Recommended Mitigation Steps Avoid hardcoding...

@arcanis/sherlock (>=1.0.0, <=1.0.16), @grafana/data (>=8.3.0-beta.1, <=8.4.0-pre-fde26b0bd9) +42 more potentially affected by CVE-2022-21680 via marked (>=4.0.0, <=4.0.9)

marked NPM version =4.0.0, =1.0.0, =8.3.0-beta.1, =8.3.0-beta.1, =8.3.0-beta.1, =8.3.0-beta.1, =0.4.0, =0.0.133, =0.2.0, =0.0.49, =3.2.0, =1.0.4, =1.0.0-test, =0.1.6, =0.1.6, =2.0.1 and more Source cves: CVE-2022-21680 Source advisory: OSV:GHSA-RRRM-QJM4-V8HF...

Incorrect internal balance bookkeeping

Handle walker Vulnerability details type: Incorrect Assumptions on External Systems The sherlock smart contract system uses internal bookkeeping of arbitrary ERC20 token balances. It doesn't assert that the ERC20 doesn't implement some non-standard behaviour. For example, deflationary tokens, or...

sherlock SherlockIM 跨站脚本漏洞

sherlock SherlockIM is an application from sherlock USA. It is used to manage various conversations with customers in WhatsApp. Sherlock SherlockIM through 2021-03-29 A cross-site scripting vulnerability exists, which can be exploited by an attacker to attach URIs to api files...

Hgiga MailSherlock SQL注入漏洞

Hgiga MailSherlock is a set of enterprise mail audit system from Henderson Hgiga, China. HGiga MailSherlock suffers from a SQL injection vulnerability, which stems from the lack of validation of externally entered SQL statements in database-based applications, and can be exploited by an attacker ...

HGiga MailSherlock SQL Injection Vulnerability

HGiga MailSherlock is an email archiving and auditing system that provides a complete email security solution. HGiga MailSherlock suffers from a SQL injection vulnerability. An attacker can use this vulnerability to inject and execute SQL commands in the URL parameters of a specific cgi page...

CVE-2020-35741

HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks...

CVE-2020-35743

HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages...

MailSherlock 跨站脚本漏洞

HGiga MailSherlock is an email archiving and auditing system that provides a complete email security solution. A cross-site scripting vulnerability exists in HGiga MailSherlock. The vulnerability stems from MailSherlock failing to properly validate specific URL parameters. An attacker can exploit...

Sifter - A OSINT, Recon And Vulnerability Scanner

Sifter is a osint, recon & vulnerability scanner. It combines a plethara of tools within different module sets in order to quickly perform recon tasks, check network firewalling, enumerate remote and local hosts, and scan for the 'blue' vulnerabilities within microsft and if unpatched, exploit...

CVE-2018-17542

SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the selectmid parameter in an letgo.cgi request...

CVE-2018-17930

A stack-based buffer overflow vulnerability has been identified in Teledyne DALSA Sherlock Version 7.2.7.4 and prior, which may allow remote code execution...

CVE-2018-17930

A stack-based buffer overflow vulnerability has been identified in Teledyne DALSA Sherlock Version 7.2.7.4 and prior, which may allow remote code execution...

Stack overflow

A stack-based buffer overflow vulnerability has been identified in Teledyne DALSA Sherlock Version 7.2.7.4 and prior, which may allow remote code execution...