CVE-2023-32058 Vyper vulnerable to integer overflow in loop

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of...

CVE-2023-31146

Vyper prior to 0.3.8 is vulnerable to out-of-bounds access in codegen when a dynarray is on both the LHS and RHS of an assignment. The length word is written before the data, enabling OOB access and potential data corruption across call frames. The issue is fixed in version 0.3.8. Affected produc...

CVE-2023-31146 Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment...

CVE-2023-31146 Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment...

Division by Zero Vulnerability in _calculateNewRewards function.

Lines of code Vulnerability details Impact The calculateNewRewards function in the smart contract performs a division operation with totalInterestEarnedInPeriod, which could be zero, but there is a problem that can result in a division-by-zero error, causing the smart contract to behave...

Lack of Access Control in GrantFund Smart Contract's fundTreasury Function

Lines of code Vulnerability details Impact The fundTreasury function in the GrantFund.sol contract allows anyone to add funds to the contract's treasury without any access control, which can lead to unauthorized access to the contract's funds. The problem with this function is that it doesn't hav...

Risk of Gas Limit Exceedance During Proposal Sorting

Lines of code Vulnerability details Impact The array of up to 10 proposals using the insertion sort algorithm in insertionSortProposalsByVotes function in the StandardFunding.sol contract but, if the number of proposals exceeds 10, the sorting process may cause the function to exceed the block ga...

Incorrect Calculation of Max Amount of Quote Tokens in moveLiquidity() Function in PositionManager.sol.

Lines of code Vulnerability details Impact The updateInterest function is called before retrieving the fromPosition value from positionsparams.tokenIdparams.fromIndex in the moveLiquidity function. This means that the bucketDeposit value may not reflect the current accrued interest, which can...

The vulnerability of microprogrammed software in Nexx Garage Door Controllers (NXG-100B, NXG-200), Nexx Smart Plugs (NXPG-100W), and Nexx Smart Alarms (NXAL-100) lies in their susceptibility to being bypassed through the use of a user-controlled key. This allows intruders to alter the settings of the devices and gain access to information about them.

The vulnerability of the microprogrammed software of the Nexx Garage Door Controller NXG-100B, NXG-200, Nexx Smart Plug NXPG-100W, and Nexx Smart Alarm NXAL-100 lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability could allow an intruder to...

The vulnerability of the microprogrammed software of the Nexx Garage Door Controller (NXG-100B, NXG-200), Nexx Smart Plug (NXPG-100W), and Nexx Smart Alarm (NXAL-100) stems from insufficient validation of input data. This allows intruders to obtain information intended for other devices.

The vulnerabilities of the microprogrammed software of the Nexx Garage Door Controller NXG-100B, NXG-200, Nexx Smart Plug NXPG-100W, and Nexx Smart Alarm NXAL-100 are related to insufficient verification of input data. Exploiting these vulnerabilities can allow an attacker operating remotely to...

Imprecise block calculation

Lines of code Vulnerability details Vulnerability details Impact @dev Roughly equivalent to the number of blocks in 7 days. @dev Roughly equivalent to the number of blocks in 90 days. @dev Roughly equivalent to the number of blocks in 10 days. As described in the NatSpec comment above these are...

The vulnerability of the microprogrammed software of the Nexx Garage Door Controller (NXG-100B, NXG-200), Nexx Smart Plug (NXPG-100W), and Nexx Smart Alarm (NXAL-100) lies in the ability to bypass authentication by using a user-controlled key. This allows intruders to execute arbitrary commands.

The vulnerability of the microprogrammed software of the Nexx Garage Door Controller NXG-100B, NXG-200, Nexx Smart Plug NXPG-100W, and Nexx Smart Alarm NXAL-100 lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows an unauthorized person...

The vulnerabilities of microprogrammed software in Nexx Garage Door Controllers (NXG-100B, NXG-200), Nexx Smart Plugs (NXPG-100W), and Nexx Smart Alarms (NXAL-100) stem from authentication procedures that have flaws. This allows intruders to register a signal that has already been registered by the device.

The vulnerabilities of the microprogrammed software of the Nexx Garage Door Controller NXG-100B, NXG-200, Nexx Smart Plug NXPG-100W, and Nexx Smart Alarm NXAL-100 are related to deficiencies in authentication procedures. Exploiting these vulnerabilities could allow an attacker, operating remotely...

Use of msg.sender in mayInteract Modifier

Lines of code Vulnerability details Impact The use of msg.sender in the mayInteract modifier in the contract. I have identified a potential vulnerability in the use of msg.sender. In this case, the vulnerability is caused by using msg.sender to authorize interactions with the contract. Since...

CVE-2022-46645

Uncontrolled resource consumption in the IntelR Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2022-46645

Uncontrolled resource consumption in the IntelR Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable denial of service via local access...

Design/Logic Flaw

Uncontrolled resource consumption in the IntelR Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2022-46645

Uncontrolled resource consumption in the IntelR Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2022-46645

Uncontrolled resource consumption in the IntelR Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2022-46645

CVE-2022-46645 affects the Intel® Smart Campus Android application prior to version 9.9. The issue is described as uncontrolled resource consumption that could allow an authenticated user to trigger a denial of service via local access. The standard vector is local, with low attack complexity and...