Inconsistent min deposit

Lines of code Vulnerability details Impact The first transfer in a vault that is based on ERC4626Cloned produces different results depending on whether it is done via deposit or via mint. While first deposit produces a number of shares that is 1:1 with the asset, in the case of mint, the results...

A malicious user can call transferWithdrawReserve() multiple times to modify s.withdrawReserve

Lines of code Vulnerability details Impact The function PublicVault.soltransferWithdrawReserve is meants to transfers funds from the PublicVault to the WithdrawProxy. However, this function has no access control, anyone can call it multiple times to modify the withdrawReserve value Proof of Conce...

User can lose 10 ethers to Vault

Lines of code Vulnerability details Impact If a user or a contract that has a large allowance 10 ethers or max on an ERC4626Cloned based Vault that has not yet received any deposits, calls mint with 0 share argument, will have a 10 ethers of the asset transferred to the Vault with no way to recla...

LienToken: Lender and liquidator can collude to block auction and seize collateral

Lines of code Vulnerability details If a lender offers a loan denominated in an ERC20 token that blocks transfers to certain addresses for example, the USDT and USDC blocklist, they may collude with a liquidator or act as the liquidator themselves to prevent loan payments, block all bids in the...

WithdrawProxy calculation error for tokens with decimals != 18 leads to claim reverting

Lines of code Vulnerability details withdrawRatio has 18 decimals 314: s.liquidationWithdrawRatio = proxySupply 315: .mulDivDown1e18, totalSupply 316: .safeCastTo88; 317: 318: currentWithdrawProxy.setWithdrawRatios.liquidationWithdrawRatio; But in WithdrawProxy.claim, transferAmount divides...

Transfer of assets should come before deleting and burning the collateral id

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Clldata id is burnt and deleted before transfer Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept...

LienToken.transferFrom There is a possibility of malicious attack

Lines of code Vulnerability details Impact Corrupt multiple key properties of public vault, causing vault not to function properly Proof of Concept When LienToken.makePayment/buyoutLien/payDebtViaClearingHouse If it corresponds to PublicVault, it will make multiple changes to the vault, such as:...

CVE-2022-36760

A flaw was found in the modproxyajp module of httpd. The connection is not closed when there is an invalid Transfer-Encoding header, allowing an attacker to smuggle requests to the AJP server, where it forwards requests...

CVE-2023-21850

Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain component: E-Business Collections. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in Oracle E-Business...

PT-2023-9424 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel version 5.10.100-emu x2rc+ Description: The vulnerability is related to the axi chan handle err function in the Linux kernel, which lacks exception protection processing for vd. This can lead to a kernel panic in exceptional case...

golang: net/http: improper sanitization of Transfer-Encoding header

A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid...

golang: net/http: handle server errors after sending GOAWAY

A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...

Deny of service in CCash.sol with "transfer" which can be unusable for smart contract calls

Lines of code Vulnerability details Impact The CCash.doTransferOut method is susceptible to denial of service. Proof of Concept The logic of the doTransferOut method in CCash is as follows: The whole user withdraw is being handled with a token.transfer call. This is unsafe as transfer has hard...

Admin/owner role lockout possible

Lines of code Vulnerability details Impact In the cash part of the code, the contract TokenProxy in Proxy.sol serves as a generic proxy for all tokens deployed using factory contracts. The factory contracts deploy a ProxyAdmin contract and a TokenProxy, alongside the respective token...

CASH token cannot be transferred among users and accounts

Lines of code Vulnerability details Impact Since the CASH token cannot be transferred unless it is explicitly allowed, the users cannot send tokens between accounts, trade it on DEXes, or integrate it into their protocols. This is a non-standard behavior that should be reported to them. Proof of...

Rounding error "confiscastes" some collateral

Lines of code Vulnerability details Impact There are no adjustments for collateral that is not returned on redemptions due to rounding errors. It will stay in the assetSender however, it will look as if was fully paid out. The rounding error also depends on the burned quantity, so it may be...

New Backdoor Created Using Leaked CIA's Hive Malware Discovered in the Wild

Unidentified threat actors have deployed a new backdoor that borrows its features from the U.S. Central Intelligence Agency CIA's Hive multi-platform malware suite, the source code of which was released by WikiLeaks in November 2017. "This is the first time we caught a variant of the CIA Hive...

Zyxel AX7501-B0 后置链接漏洞

The Zyxel AX7501-B0 is a router from China Heqin Zyxel. A security vulnerability exists in Zyxel AX7501-B0 versions prior to V5.17ABPC.3C0. An attacker could exploit the vulnerability to access the root filesystem by creating a symbolic link on an external storage medium e.g., a USB flash drive a...

PT-2023-15973 · Sauter · Sauter Controls Nova 200–220 Series

Name of the Vulnerable Software and Affected Versions: SAUTER Controls Nova 200–220 Series versions 3.3-006 and prior BACnetstac versions 4.2.1 and prior Description: The issue affects device management, where sensitive information such as credentials is sent in cleartext through FTP and Telnet...