Unlimited minting of fractional tokens by calling Pair.wrap() multiple times

Lines of code Vulnerability details Impact User can mint an unlimited amount of fractional tokens and break the protocol by selling the tokens. Proof of Concept NFTs can be traded for 1e18 fractional tokens by calling the function wrap. Wrap calls validateTokenIdstokenIds, proofs which in turn ru...

Possible Reentrancy Vulnerability

Lines of code Vulnerability details Impact In Add function, in case of non Eth Base Token, LP Tokens are minted for LP Provider before transferring the Base Token from Provider to Contract. In remove function, Fractional Tokens are Transferred to LP Provider before Burning the LP Token. In wrap...

@alexktzk/cz-customizable (>=1.0.0, <=1.1.0), @algolia/coquille (>=0.0.2, <=0.0.13) +377 more potentially affected by CVE-2023-26115 via word-wrap (>=1.0.3, <=1.2.3)

word-wrap NPM version =1.0.3, =1.0.0, =0.0.2, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.4.2, =0.0.0, =1.0.0, =0.1.0-preview, =0.1.0-preview, =6.0.0-alpha.16.20220105.1, =0.1.3, =0.1.17 and more Source cves: CVE-2023-26115 Source advisory: SNYK:JS-WORDWRAP-3149973...

Malicious code in awodr-wrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b37b691358f802cf42a7236eecfa42f04d42c2c961d085fd8f7ee928f236db11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1190 Malicious code in awodr-wrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b37b691358f802cf42a7236eecfa42f04d42c2c961d085fd8f7ee928f236db11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DEBIAN-CVE-2022-31160

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents...

Malicious code in makerjs-wrap-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be2128bc765928893850f3d6426a53fe36709f7733af266b64e522fc872e6234 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DoS in wrap and unwrap

Lines of code Vulnerability details Impact the code is doing wrong check, so when things will work it will revert. Proof of Concept In the function wrap there is this lines: if error = ICERC20token.mintamount != NOERROR revert FuseErrorerror; but mint returns the amount that minted, so when error...

new packages: perl-Text-Tabs+Wrap

An update is available for perl-Text-Tabs+Wrap. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rock...

GHSA-P9CV-HRXR-FXX8 Restkit Does Not Validate TLS certificates

Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrapsocket function in Python with the default CERTNONE value for the certreqs argument...

A week in security (May 9 – 15)

Last week on Malwarebytes Labs: How to spot the signs of a virtual kidnap scam Virtual credit cards coming to Chrome: What you need to know Clearview AI banned from selling facial recognition data in the US Cyberattacks on SATCOM networks attributed to Russian threat actors F5 BIG-IP vulnerabilit...

YearnTokenAdapter's wrap can become stuck as it uses one step approval for an arbitrary underlying

Lines of code Vulnerability details Some tokens do not allow for approval of positive amount when allowance is positive already to handle approval race condition, most known example is USDT. This can cause the function to stuck whenever a combination of such a token and leftover approval be met...

CVE-2021-27433

ARM mbed-ualloc memory library version 1.3.0 is vulnerable to integer wrap-around in function mbedkrbs, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution...

CVE-2021-27419

uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution...

CVE-2021-27425

Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mmmalloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution...

CVE-2021-27427

RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution...

CVE-2021-27431

ARM CMSIS RTOS2 versions prior to 2.1.3 are vulnerable to integer wrap-around inosRtxMemoryAlloc local malloc equivalent function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or injected code execution...

CVE-2021-27435

ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in mallocwrapper function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution...

CVE-2021-27439

TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tosmmheapalloc incorrect calculation of effective memory allocation size. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code...

DEBIAN-CVE-2021-27419

uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution...