849 matches found
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PT-2024-13303 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The issue was investigated and found not to be a security issue. It was withdrawn by its CNA. Recommendations: At the moment, there is no information about a newer version th...
CVE-2023-51200
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability...
FTC Bans InMarket for Selling Precise User Location Without Consent
The U.S. Federal Trade Commission FTC is continuing to clamp down on data brokers by prohibiting InMarket Media from selling or licensing precise location data. The settlement is part of allegations that the Texas-based company did not inform or seek consent from consumers before using their...
Insufficient Fund Guard for Treasury Reward Rebalancing Due to Unrestricted Withdrawals
Lines of code Vulnerability details Impact The potential issue identified in the Treasury.rebalanceTreasuryinvolves the risk of failing to transfer treasury rewards from ETHFromServices to ETHOwned due to insufficient funds in ETHFromServices. This situation can arise when the withdrawToAccount...
tokens can be deposited and immediately withdrawn before the intended lock time by depositing right before expiry
Lines of code Vulnerability details Impact tokens can be deposited and immediately withdrawn before the intended lock time by depositing right before expiry. Proof of Concept There is edge cases around the locking and unlocking periods that are not fully considered in the contract. Specifically,...
Pausing the GuardCM does not work because the governorCheckProposalId is never set
Lines of code Vulnerability details Impact Since the governorCheckProposalId of the proposal to check the activity of the governance is never set in GuardCM, the CM can never pause GuardCM, even if the governance is inactive. This will result in a stagnation of the protocol since no significant...
Withdraw amount returned by getLiquidityAmountsAndPositions may be incorrect
Lines of code Vulnerability details Impact The getLiquidityAmountsAndPositions function in the liquiditylockbox contract is used to calculate the liquidity amounts and positions to be withdrawn for a given total withdrawal amount. It iterates through each deposited position following a FIFO order...
Griefing attack on liquidity_lockbox withdrawals due to lack of minimum deposit
Lines of code Vulnerability details Impact The liquiditylockbox contract does not enforce a minimum deposit limit. This allows a user to open many positions with minimum liquidity, forcing other users to close these positions one by one in order to withdraw. This could lead to a griefing attack...
LP rewards in liquidity_lockbox can be arbitraged
Lines of code Vulnerability details Impact The liquiditylockbox contract is designed to handle liquidity positions in a specific Orca LP pool. Users can deposit their LP NFTs into the contract, receiving in exchange tokens according to their position size. These tokens are minted with the goal of...
Attacker can cause deposits to be locked in the Solana lockbox
Lines of code Vulnerability details Impact An attacker can cause deposits to be locked in the lockbox Proof of Concept In withdraw, if the position has 0 liquidity the execution is reverted function withdrawuint64 amount external address positionAddress =...
GHSA-4MVM-XH8J-FV27 Duplicate Advisory: govuk_tech_docs vulnerable to unescaped HTML on search results page
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x2xw-hw8g-6773. This link is maintained to preserve external references. Original Description versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may ...
Ether will get stuck in ERC20TokenEmitter
Lines of code Vulnerability details ERC20TokenEmitter.sol:buyToken distributes the funds sent to purchase the tokens in the following way: 2.5% of the funds are sent to the RevolutionProtocolRewards contract. From the remaining funds, a percentage dependent on the creatorRateBps variable is sent ...
Number withdrawn
Kashipara Job Portal is an online job portal system from Kashipara. This CVE number has been withdrawn...
Number withdrawn
Kashipara Job Portal is an online job portal system from Kashipara. This CVE number has been withdrawn...
borrower can prevent liquidity provider from withdrawing their liquidity
Lines of code Vulnerability details Description When a liquidity provider wants to withdraw their liquidity they can call ParticlePositionManager::reclaimLiquidity. This will prevent any renewals: ParticlePositionManager::addPremium: File: protocol/ParticlePositionManager.sol 508: // check LP...
Number withdrawn
Kashipara Job Portal is an online job portal system from Kashipara. This CVE number has been withdrawn...
In case if wLP will be blacklisted then user will not be able to withdraw it
Lines of code Vulnerability details Proof of Concept When users deposit wLP tokens as collateral, then they are checked to be whitelisted. Later, it's possible that for some reason wLP token will be backlisted by governor. And once it's done, then users, who already used that wLP tokens as...