Controller.setCap sets wrong vault balance

Handle cmichel Vulnerability details The Controller.setCap function sets a cap for a strategy and withdraws any excess amounts diff. The vault balance is decreased by the entire strategy balance instead of by this diff: // @audit why not sub diff? vaultDetailsvault.balance =...

Controller.withdraw(...) User may lose funds when withdraw wantToken from the underlying contract

Handle WatchPug Vulnerability details The wantToken of the strategy may be different from the token argument of Controller.withdrawaddress token, uint256 amount according to code at line 469-474 of Controller.sol. if want != token address converter = vaultDetailsmsg.sender.converter;...

Vault may not have enough tokens for withdraw

Handle 0xRajeev Vulnerability details Impact There is an assumption in LegacyController.vault that the vault will have enough tokens0 to cover the balance difference. If not, the user may receive less than amount requested and balance funds get lost/locked unless the vault withdraws from the...

Incorrect access control on Harvester add/remove strategy functions

Handle 0xRajeev Vulnerability details Impact The documentation comments indicate that addStrategy and removeStrategy are gov/strategist only functions which is true for setHarvester and setSlippage but add/remove strategy have the incorrect onlyController modifier instead of onlyStrategist. Proof...

Reordering of strategies on Controller does not reorder strategies in Harvester

Handle itsmeSTYJ Vulnerability details Impact The harvester might harvest the wrong strategy because the array of strategies that it stored in its storage is not in the same order as the one stored in the controller. Recommended Mitigation Steps Add a similar reorder strategy function in...

Controller transfer extra token on withdrawing tokens

Handle jonah1005 Vulnerability details Impact The Controlle�r's function withdrawaddress token, uint256 amount should return whatever amount of the token user/vault asks. However, it tries to withdraw strategy.want token and convert it. Take for example, when a user/vault calls withdrawdai, 100,...

set cap breaks vault's Balance

Handle jonah1005 Vulnerability details Impact In controller.sol's function setCap, the contract wrongly handles vaultDetailsvault.balance. While the balance should be decreased by the difference of strategies balance, it subtracts the remaining balance of the strategy. Controller.solL262-L278...

This Week in Security News - September 10, 2021

Biden announces cybersecurity initiative partnership, US Government seeks public feedback on draft federal zero trust strategy and more...

Lift and drag: confronting complacency and disrupting inertia in cybersecurity strategy

Within corporate cybersecurity, resistance presents in a variety of forms. Individuals and institutions alike often face overwhelming peer pressure to "keep doing what made us successful in the past." In the face of that pressure, it can be difficult to generate or sustain momentum toward...

What Is Zero Trust and Why Does It Matter?

There has been a lot of discussion around Zero Trust recently—is it a solution? A strategy? A pipe dream? Eric Skinner from Trend Micro gets real about Zero Trust and explains what it really is, and how organizations can use it to be more resilient...

NVIDIA GPU Display Drivers - July 2021 - Lenovo Support US

No description provided...

NVIDIA GeForce Experience - June 2021 - Lenovo Support US

No description provided...

jenkins-2-plugins/matrix-auth: Incorrect permission checks in Matrix Authorization Strategy Plugin

A flaw was found in Jenkins Matrix Authorization Strategy Plugin. The jenkins plugin does not correctly perform permission checks, as consequences this allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders. The highest...

A Cloud Migration Strategy with Security Embedded

Learn how to build a cloud migration strategy that keeps security in mind...

CVE-2021-22707

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker t...

Why Your Business Needs a Long-Term Remote Security Strategy

When COVID-19 first emerged, companies across all sectors of the economy were forced to rapidly transition to remote work. The goal was simple: Ensuring business continuity in the face of an unprecedented challenge — a challenge that most assumed would come and go in short order. As vaccines...

Apps Built Better: DevSecOps, a Security Silver Bullet

Security should never be an afterthought when developing software and applications. However, as technological advances continue to take hold, the security tools many rely on are changing in real-time, and combatting potential breaches or hacks of your wares before they arise now requires new...

NetApp SANtricity OS Controller Software 11.x Vulnerabilities - Lenovo Support US

No description provided...

Kaseya CEO: “The impact of this incredibly sophisticated attack is very minimal”

The official YouTube channel of Kaseya, the latest organization attacked by no less than the criminals behind REvil ransomware, released a video of Fred Voccola, Kaseyas CEO, giving a first-hand account of what happened during the attack, the facts on affected customers, and the next steps theyre...

What Are Red Team Exercises and Why Are They Important?

Pick a side. It’s game time, and nothing is off the table. -- For most organizations, a true defense-in-depth strategy includes the proactive testing of company cyber defenses. A Red Team Exercise is designed to reveal vulnerabilities in a companys security through hands-on testing, uncovering...