4337-snap (>=0.1.0, <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0, <=1.0.5) +1254 more potentially affected by CVE-2022-31198 via @openzeppelin/contracts (>=4.3.0, <=4.7.1)

@openzeppelin/contracts NPM version =4.3.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =1.0.0, =0.2.0, =4.14.3, =1.0.2, =4.0.0-prerelease, =4.0.1-alpha, =2.0.0-beta.1, =3.1.0 and more Source cves: CVE-2022-31198 Source advisory: OSV:GHSA-XRC4-737V-9Q75...

@abacus-network/helloworld (>=0.2.1-alpha, <=0.2.1-beta2), @alt-research/orbit-sdk-avail (>=0.9.1, <=0.9.11) +106 more potentially affected by CVE-2022-31198 via @openzeppelin/contracts-upgradeable (>=4.3.0, <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =4.3.0, =0.2.1-alpha, =0.9.1, =0.19.0-beta.0, =0.1.0-alpha, =0.24.2, =1.0.0-beta.1, =0.6.0-beta.0, =1.1.4-migration-beta.0, =1.0.0-beta.0, =1.0.0-upstream-0.19.0, =1.4.0, =1.5.0-beta.0 and more Source cves: CVE-2022-31198 Source advisory:...

CVE-2021-26639

This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerability to leak all files in the server without logging in system...

CVE-2021-26639

This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerability to leak all files in the server without logging in system...

Input validation

This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerability to leak all files in the server without logging in system...

CVE-2021-26639 WISA Smart Wing CMS File Download Vulnerability

This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerability to leak all files in the server without logging in system...

CVE-2021-26639

CVE-2021-26639 affects WISA Smart Wing CMS. The vulnerability arises from insufficient input validation in specific functions, allowing remote attackers to leak all files on the server without authentication. Reported details consistently describe unauthorized file disclosure as the impact. No co...

Use of transfer() instead of call() to send eth

Lines of code Vulnerability details Use of transfer instead of call to send eth Impact OZSafeERC20.safeTransfer relies on transfer at the end, but with a check of the returning value. Same happens with OZSafeERC20.safeTransferFrom and transferFrom. However, the use of transfer might render ETH...

repayAsset() but you will not receive your Collateral

Lines of code Vulnerability details Impact The user will just pay down the debt Proof of Concept By invoking repayAsset you will just pay the Asset Token, on the other hand, he does not send any amount of my Collateral Recommended Mitigation Steps Add a function to send the Collateral after...

WISA Smart Wing CMS 安全漏洞

WISA Smart Wing CMS is a content management system from the Korean company WISA. A security vulnerability exists in WISA Smart Wing CMS that stems from a lack of validation of input values for specific functions. A remote attacker could exploit the vulnerability to disclose all files in the serve...

Format string

OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issu...

Bad access control in AdminRole.sol can lead to all funds being stolen from FoundationTreasury.sol

Lines of code Vulnerability details Proof of concept FoundationTreasury.sol inherits CollateralManagement.sol which has the method function withdrawFundsaddress payable to, uint256 amount external onlyAdmin that can withdraw the whole balance of the treasury to the to address. It looks like it is...

User can't undelegate after he has delegated to someone who have different unlock time.

Lines of code Vulnerability details Impact User can't undelegate after he has delegated to someone who have different unlock time. It will be reverted with "Only delegate to longer lock" Proof of Concept I have created a new testcase to demonstrate this issue. I will upload it to 24 hours after...

Users can create an un-bannable contract

Lines of code Vulnerability details Impact Users can create an un-bannable contract by working from a contract's constructor and then self-destructing on each instantiation. Users can also deterministically deploy the contract to the same address every time they want to interact with fiatDAO...

@0xabcdefg/smart-order-router (>=1.0.0, <=1.0.5), @0xabcdefg/universal-router-sdk (>=1.0.0, <=1.0.2) +909 more potentially affected by CVE-2022-35916 via @openzeppelin/contracts (>=4.6.0, <=4.7.1)

@openzeppelin/contracts NPM version =4.6.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =1.0.0, =0.2.0, =4.14.3, =2.0.17, =0.0.1, =0.0.1, =0.0.1, =0.0.17 and more Source cves: CVE-2022-35916 Source advisory: OSV:GHSA-9J3M-G383-29QR...

@acatalan/erc223-20-contracts (0.0.3), @adacash/liquidity-staker (0.0.1) +275 more potentially affected by CVE-2022-35915 via openzeppelin-solidity (>=2.0.0, <=3.4.2)

openzeppelin-solidity NPM version =2.0.0, =1.1.1, =0.3.0, =0.5.1, =0.3.2, =0.3.1, =0.3.1, =0.0.3, =0.1.0, =0.1.0, =2.2.1, =0.1.0, =0.1.4 and more Source cves: CVE-2022-35915 Source advisory: OSV:GHSA-7GRF-83VW-6F5X...

@centrifuge/ethereum-contracts (>=0.5.0, <=1.0.3-canary.4) potentially affected by CVE-2022-35915 via openzeppelin-eth (2.1.3)

openzeppelin-eth NPM version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on openzeppelin-eth and may be impacted: - @centrifuge/ethereum-contracts =0.5.0, =1.0.3-canary.4 Source cves: CVE-2022-35915 Source advisory: OSV:GHSA-7GRF-83VW-6F5X...

0x-hunter-core (>=1.0.0-33, <=1.0.0-38), 1155-to-20 (>=1.0.0, <=1.0.2) +3170 more potentially affected by CVE-2022-35915 via @openzeppelin/contracts (>=2.3.0, <=4.7.1)

@openzeppelin/contracts NPM version =2.3.0, =1.0.0-33, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.4.1, =1.0.0, =1.0.0-alpha.0, =1.1.0-alpha.0 and more Source cves: CVE-2022-35915 Source advisory: OSV:GHSA-7GRF-83VW-6F5X...

CVE-2022-35961 ECDSA signature malleability in OpenZeppelin Contracts

OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issu...

CVE-2022-35961

OpenZeppelin Contracts (ECDSA.recover and ECDSA.tryRecover) suffer signature malleability due to acceptance of EIP-2098 compact signatures in the single-bytes variants (not when using r, v, s or r, vs). This could allow a reused/double-submitted signature to bypass replay protection in contracts ...