Vulnerability in Keccak Function Used for Equality Check in equals() Function.

Lines of code Vulnerability details Impact The BytesUtils library is using Keccak function to check for equality in the equals function. This is a security concern since the Keccak function is vulnerable to hash collisions, which could allow a malicious user to create an input that matches a...

CVE-2023-30629

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the rawcall with revertonfailure=False and maxoutsize=0 receives the wrong response from rawcall. Depending on the...

Design/Logic Flaw

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the rawcall with revertonfailure=False and maxoutsize=0 receives the wrong response from rawcall. Depending on the...

CVE-2023-30629

CVE-2023-30629 affects the Vyper compiler (versions 0.3.1–0.3.7). When using built-in function raw_call with revert_on_failure=False and max_outsize=0 , the compiler generates incorrect bytecode, causing the returned value from the call to be an unreliable boolean (may be True or False) depending...

CVE-2023-30629 Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success value

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the rawcall with revertonfailure=False and maxoutsize=0 receives the wrong response from rawcall. Depending on the...

CVE-2023-30629 Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success value

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the rawcall with revertonfailure=False and maxoutsize=0 receives the wrong response from rawcall. Depending on the...

CVE-2023-29780

Third Reality Smart Blind 1.00.54 contains a denial-of-service vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes...

CVE-2023-29780

Third Reality Smart Blind 1.00.54 contains a denial-of-service vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes...

Denial of service

Third Reality Smart Blind 1.00.54 contains a denial-of-service vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes...

CVE-2023-29780

Third Reality Smart Blind 1.00.54 contains a denial-of-service vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes...

CVE-2023-29780

CVE-2023-29780 affects Third Reality Smart Blind v1.00.54. The vulnerability allows a remote attacker to send malicious Zigbee messages to the device, causing it to crash (denial-of-service). The NVD/CVSS data indicate a NETWORK attack with no authentication and no user interaction, resulting in ...

Third Reality Smart Blind 输入验证错误漏洞

Third Reality Smart Blind is a smart blind from Third Reality. A security vulnerability exists in Third Reality Smart Blind version 1.00.54. An attacker exploited the vulnerability to send a malicious Zigbee message to a vulnerable device and cause a crash...

PT-2023-22417 · Third Reality · Third Reality Smart Blind

Name of the Vulnerable Software and Affected Versions: Third Reality Smart Blind version 1.00.54 Description: The issue allows a remote attacker to send malicious Zigbee messages to a vulnerable device, causing it to crash. This is a denial-of-service vulnerability. Recommendations: For Third...

CVE-2023-29780

Third Reality Smart Blind 1.00.54 contains a denial-of-service vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes...

CVE-2023-1370

A flaw was found in the json-smart package. This security flaw occurs when reaching a ‘‘ or ‘‘ character in the JSON input, and the code parses an array or an object, respectively. The 3PP does not have any limit to the nesting of such arrays or objects. Since nested arrays and objects are parsed...

4337-snap (>=0.1.0, <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0, <=1.0.5) +1448 more potentially affected by CVE-2023-30542 via @openzeppelin/contracts (>=4.3.0, <=4.8.2)

@openzeppelin/contracts NPM version =4.3.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2023-30542 Source advisory: OSV:GHSA-93HQ-5WGC-JC82...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +362 more potentially affected by CVE-2023-30542 via @openzeppelin/contracts-upgradeable (>=4.3.0, <=4.8.2)

@openzeppelin/contracts-upgradeable NPM version =4.3.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2023-30542 Source advisory:...

CISA and Partners Release Cybersecurity Best Practices for Smart Cities

Today, CISA, NSA, FBI, NCSC-UKlink is external, ACSClink is external, CCCSlink is external and NCSC-NZlink is external released a joint guide: Cybersecurity Best Practices for Smart Cities. Smart cities may create safer, more efficient, resilient communities through technological innovation and...

Underflow in suggestMinter function

Lines of code Vulnerability details Impact The suggestMinter function in the smart contract allows users to suggest a new minter address by specifying an application period, an application fee, and a message. The function sets the mintersminter mapping to the current block timestamp plus the...

An attacker can mint himself many tokens for free by cloning a position and adjusting its price

Lines of code Vulnerability details Impact A malicious attacker can mint himself the max limit amount of tokens of any position for free, by cloning a position and manipulating its price. Proof of Concept Steps overview: 1. a The attacker clones an existing position 2. b The attacker sets the pri...