Swapping lacks deadline check

Lines of code Vulnerability details Impact There is no deadline when swapping tokens using EvolvingProteus. Swaps that are done through low gas transactions may be stuck in the mempool for a long time, resulting in unfavourable swap. Proof of Concept Evolving prometeus seems like an upgrade to...

Dell BIOS 安全漏洞

Dell BIOS is embedded software on a small memory chip on a computer motherboard from Dell USA. A security vulnerability exists in Dell BIOS that originates from the possibility that a locally authenticated malicious user could execute arbitrary code on the system using specifically timed DMA...

Investing in Ethereum Blockchain-based JasmyCoin: Guide

By Owais Sultan JasmyCoin operates on blockchain technology as a decentralized digital currency, ensuring secure and transparent transactions. This is a post from HackRead.com Read the original post: Investing in Ethereum Blockchain-based JasmyCoin: Guide...

Investing in Ethereum Blockchain-based JasmyCoin: Guide

By Owais Sultan JasmyCoin operates on blockchain technology as a decentralized digital currency, ensuring secure and transparent transactions. This is a post from HackRead.com Read the original post: Investing in Ethereum Blockchain-based JasmyCoin: Guide...

SETTING block.timestamp AS THE DEADLINE COULD LEAD TO HIGHER RATE OF FAILED TRANSACTIONS

Lines of code Vulnerability details Impact The OptionsPositionManager.swapExactTokensForTokens function is used to swap assets for exact assets. Here the exact amount of source token is swapped for an amount of target token. The function uses the IUniswapV2Router01.swapExactTokensForTokens call f...

DEPRECATED POOLS CAN BE USED IN THE CRITICAL TRANSACTION EXECUTIONS OF THE OptionsPositionManager CONTRACT

Lines of code Vulnerability details Impact The PositionManager.getPoolAddresses function is used to get the important address details of the RoePool to be used in the critical function executions of the OptionsPositionManager contract such as executeBuyOptions, executeLiquidation,...

European Bank Customers Targeted in SpyNote Android Trojan Campaign

Various European customers of different banks are being targeted by an Android banking trojan called SpyNote as part of an aggressive campaign detected in June and July 2023. "The spyware is distributed through email phishing or smishing campaigns and the fraudulent activities are executed with a...

[SECURITY] Fedora 37 Update: redis-7.0.12-1.fc37

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

This Week in Spring - July 18th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in crazy cool Kuala Lumpur, Malaysia. If you're around, I'll be doing a presentation this Thursday the 20th of July, and I'd love to see you there! Then, after a quick vacation, it's off to Tokyo, Japan, where I'll also b...

Unintended or Malicious Use of Prize Winners' Hooks

Lines of code Vulnerability details Impact The setHooks function in Vault.sol allows users to set arbitrary hooks, potentially enabling them to make external calls with unintended consequences. This vulnerability could lead to various unexpected behaviors, such as unauthorized side transactions...

GO-2023-1883 Denial of service via OOM in github.com/cometbft/cometbft

A bug in the CometBFT middleware causes the mempool's two data structures to fall out of sync. This can lead to duplicate transactions that cannot be removed, even after they are committed in a block. The only way to remove the transaction is to restart the node. This can be exploited by an...

GHSA-J494-7X2V-VVVP mx-chain-go's relayed transactions always increment nonce

Impact When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on a targeted account. The fix is a breaking change so a new flag RelayedNonceFixEnableEpoch was...

mx-chain-go 资源管理错误漏洞

mx-chain-go is a go implementation of the MultiversX protocol open-sourced by MultiversX. mx-chain-go suffers from a resource management error vulnerability that stems from the fact that when executing a relay transaction, if the internal transaction fails, it increases the random number of sende...

PT-2023-24890 · Multiversx · Mx-Chain-Go

Name of the Vulnerable Software and Affected Versions: mx-chain-go versions prior to 1.4.17 Description: The issue occurs when executing a relayed transaction in mx-chain-go, the official implementation of the MultiversX blockchain protocol. If the inner transaction fails, it increases the inner...

Denial Of Service (DoS)

github.com/cometbft/cometbft is vulnerable to Denial of Service DoS attacks. A list and a map are the two data structures that the mempool utilizes to keep track of unfinished transactions. The same transaction may occur several times if these structures are out of sync, even though they should b...

CVE-2021-4411

The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the wpepdownloadtransactioninexcel function. This makes it possible for unauthenticated attackers...

Revolut Faces $20 Million Loss as Attackers Exploit Payment System Weakness

Malicious actors exploited an unknown flaw in Revolut's payment systems to steal more than $20 million of the company's funds in early 2022. The development was reported by the Financial Times, citing multiple unnamed sources with knowledge of the incident. The breach has not been disclosed...

Well.sol#removeLiquidityImbalanced - Handling Excess Reserves in removeLiquidityImbalanced Function to Prevent Unnecessary Reverts

Lines of code Vulnerability details Impact The removeLiquidityImbalanced function in the Well.sol contract is vulnerable to a potential underflow. This could disrupt the contract's functionality and prevent users from removing liquidity in an imbalanced manner. Furthermore, the function does not...

CVE-2023-37192

Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing...

CVE-2023-37192

Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing...