Lending Pair initialize function can be front run.

Handle jonah1005 Vulnerability details Impact LendingPair does not initialize tokenMaster, controller, tokens. A hacker can listen the deployer address and front run the initialize transaction. The initialized contract would look almost exactly the same if the hacker only replace lpTokenMaster wi...

withdraw timelock can be circumvented

Handle cmichel Vulnerability details One can withdraw the entire PrizePool deposit by circumventing the timelock. Assume the user has no credits for ease of computation: user calls withdrawWithTimelockFromuser, amount=userBalance with their entire balance. This "mints" an equivalent amount of...

Rewards cannot be withdrawn

Email address [email protected] Handle @cmichelio Eth address 0x6823636c2462cfdcD8d33fE53fBCD0EdbE2752ad Vulnerability details The rewards for a recipient in IncentiveDistribution.sol are stored in the storage mapping indexed by recipient accruedRewardrecipient and the recipient is the actual margi...

NCR SelfServ ATM dispenser software contains multiple vulnerabilities

Overview NCR SelfServ automated teller machines ATMs running APTRA XFS 05.01.00 or older are vulnerable to physical attacks on the communications bus between the currency dispenser component and the host computer. Description NCR SelfServ ATMs running APTRA XFS 05.01.00 or older contain...

STeX White List Numeric Error Vulnerability

STeX White List STEWL is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'withdrawToFounders' function in the smart contract implementation of STEWL. An attacker could exploit this vulnerability to cause loss of funds...

Other vulnerabilities in Ethernet smart contract FALCON 0x5AEf06eC39e98c05201ee1e54b653c372ECb9Cf3

FALCON is an ERC20 token on ethereum. The smart contract address is 0x5AEf06eC39e98c05201ee1e54b653c372ECb9Cf3, and its function Mining24 on line 102 can modify Owner and has no permission check, leading to an attacker being able to call the withdraw function line 274 to transfer all the ether in...

Other vulnerabilities exist in the ethereum smart contract Tubigo 0x43EFc486d1c7c5Cb0193E409a73Aa33786F5197c

TubigoToken is an ERC20 token on a table. The smart contract address is 0x43EFc486d1c7c5Cb0193E409a73Aa33786F5197c, and its function Mining24 at line 102 can modify the Owner without any permission check. The attacker can call the withdraw function line 274 to transfer all the ether in the contra...

nfdump Integer Overflow Vulnerability

nfdump is a toolset for collecting and processing netflow and sflow data sent by netflow/sflow compatible devices. An integer overflow vulnerability in the Processipfixtemplatewithdraw function in ipfix.c in nfdump 1.6.17 and earlier can be exploited by a remote attacker to cause the process to...

PT-2019-13705 · Nfdump +1 · Nfdump +1

Name of the Vulnerable Software and Affected Versions: nfdump versions 1.6.17 and earlier Description: The issue is related to an integer overflow in the Process ipfix template withdraw function in ipfix.c, which can be exploited to crash the process remotely, resulting in a denial of service...

Scientific Linux Security Update : gfs-kmod on SL 5.0-5.4 i386/x86_64

This updated gfs-kmod is already in SL 5.5. A flaw was found in the gfslock implementation. The GFS locking code could skip the lock operation for files that have the SISGID bit set-group-ID on execution in their mode set. A local, unprivileged user on a system that has a GFS file system mounted...