Improper Preservation Of Permissions

github.com/authelia/authelia/ is vulnerable to Improper Preservation Of Permissions. The vulnerability is due to a flaw in the implementation of user group management. This can lead to unexpected outcomes like the changes to a user group are not taken into account by access control for longer tha...

SafeID's ownership is not checked properly in BasicAction.generateDebt()

Lines of code Vulnerability details Impact the ownership of safe's id passed in BasicAction.generateDebt is never checked which can lead to unexpected results Proof of Concept BasicAction.generateDebt has the following code - function generateDebt address manager, address taxCollector, address...

Manipulation of NFV can trick it's buyer to have it on unexpected condition.

Lines of code Vulnerability details Impact NFV can be sold at a price not expected by the user or may be susceptible to liquidation shortly after buying it. Proof of Concept openSAFE function in ODSafeManager is supposed to be called by the ODProxy and mints nft for it, furthermore it calls...

Upgraded Q -> 2 from #13 [1680615156614]

Judge has assessed an item in Issue 13 as 2 risk. The relevant finding follows: Lines of code Vulnerability details Impact The MuteBond.deposit function allows the user to purchase a bond with LP tokens and receive MUTE tokens in return. The bondPrice increases linearly over time which I should...

MuteBond.sol: deposit function allows no control for payout and value which leads to unexpected purchases of bonds

Lines of code Vulnerability details Impact The MuteBond.deposit function allows the user to purchase a bond with LP tokens and receive MUTE tokens in return. The bondPrice increases linearly over time which I should mention means the bond gets cheaper; the naming is a bit confusing. There is...

ISC BIND 9 zero length rdata named vulnerability

Overview ISC BIND 9 named contains a vulnerability that could allow a attacker to cause named to terminate unexpectedly. Description According to ISC's security advisory:This problem was uncovered while testing with experimental DNS record types. It is possible to add records to BIND with null ze...