CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

call() should be used instead of transfer() on an address payable

Lines of code Vulnerability details Impact The use of the transfer function for sending ETH to an address will inevitably make the transaction fail when: The claimer smart contract does not implement a payable function. The claimer smart contract does implement a payable fallback which uses more...

REENTRANCY

Lines of code Vulnerability details Impact In a Re-entrancy attack, a malicious contract calls back into the calling contract before the first invocation of the function is finished. This may cause the different invocations of the function to interact in undesirable ways, especially in cases wher...

INCORRECT ACCESS CONTROL

Lines of code Vulnerability details Impact Access control plays an important role in segregation of privileges in smart contracts and other applications. If this is misconfigured or not properly validated on sensitive functions, it may lead to loss of funds, tokens and in some cases compromise of...

INCORRECT ACCESS CONTROL

Lines of code https...

Unauthorized Access to Critical Functions in Smart Contract

Lines of code Vulnerability details Description The provided smart contract contains critical functions, such as close, closeDebt, and withdrawOptionAssets, that can be called by any external address without proper authentication or authorization checks. This lack of access control exposes the...

Incorrect implementation of solvent() modifier

Lines of code Vulnerability details Impact In Market.sol, solvent modifier is given as below, modifier solventaddress from updateExchangeRate; accrue; ; requireisSolventfrom, exchangeRate, "Market: insolvent"; Here the modifier has used the accrue directly, however while the functions being used ...

CVE-2023-4121

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722. It has been classified as critical. Affected is an unknown function. The manipulation of the argument fileupload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...

Design/Logic Flaw

A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20230722. It has been classified as critical. Affected is an unknown function. The manipulation of the argument fileupload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has...

CVE-2023-4121 Byzoro Smart S85F Management Platform unrestricted upload

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722. It has been classified as critical. Affected is an unknown function. The manipulation of the argument fileupload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...

CVE-2023-4121

CVE-2023-4121 affects Byzoro Smart S85F Management Platform up to 20230722. The issue is an unrestricted file upload caused by manipulation of the file_upload argument, allowing remote exploitation. Multiple connected sources confirm the vulnerability exists in this product/version and can be tri...

CVE-2023-4120

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the file importhtml.php. The manipulation of the argument sql leads to command injection. The attack may be initiated remotely. The exploit h...

Command injection

A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the file importhtml.php. The manipulation of the argument sql leads to command injection. The attack may be initiated remotely. The...

CVE-2023-4120 Byzoro Smart S85F Management Platform importhtml.php command injection

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the file importhtml.php. The manipulation of the argument sql leads to command injection. The attack may be initiated remotely. The exploit h...

CVE-2023-4120 Byzoro Smart S85F Management Platform importhtml.php command injection

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the file importhtml.php. The manipulation of the argument sql leads to command injection. The attack may be initiated remotely. The exploit h...

CVE-2023-4120

CVE-2023-4120 affects Byzoro Smart S85F Management Platform (versions up to 20230722). The vulnerability is in the processing of the file importhtml.php where manipulation of the sql argument leads to remote command injection. Exploitation is possible remotely and has been publicly disclosed per ...

CurveVolatileCollateral._underlyingRefPerTok() Possible manipulation

Lines of code Vulnerability details Impact curvePool.getvirtualprice May be manipulated to cause malicious entry DISABLED Proof of Concept CurveVolatileCollateral.underlyingRefPerTok return curvePool.getvirtualprice function underlyingRefPerTok internal view virtual override returns uint192 @...

PT-2023-27853 · Byzoro · Byzoro Smart S85F Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S85F Management Platform versions up to 20230722 Description: A critical issue affects the processing of the file importhtml.php, where the manipulation of the sql argument leads to command injection. The attack can be initiated...