115 matches found
WithdrawTo() needs a zero address check for _to parameter
Lines of code Vulnerability details Impact The withdrawTo function in Booster.sol is missing a zero address check for to parameter. Tokens would be lost if to is zero address. Proof of Concept Tools Used Manual review Recommended Mitigation Steps User require to ensure to is not a zero address. -...
Can steal yVault deposits due to bad initial shares calculation
Lines of code Vulnerability details Impact The yVault.deposit function mints initial shares equal to the deposited amount. The deposit / withdraw functions also use the balance, which includes the contract balance token.balanceOfaddressthis, to compute the shares. It's possible to increase the...
Burning collateralContractAddress by mistake in closeLoan
Lines of code closeLoan; L116-216 Vulnerability details Impact ERC721 used as collateral could possibly never return to borrower. Proof of Concept No zero address check for sendCollateralTo might lead to sending ERC721 used as collateral to inexistent address. Use of transferFrom instead of...
Owner Can Stop Bridge All Functionality Only With One Change
Lines of code Vulnerability details Impact Owner can stop all bridge functionality with the changing cBridge contract address with the zero. The centralized structure can cause to pause all operations. Proof of Concept Tools Used Code Review Recommended Mitigation Steps It is recommended to place...
Missing receiver validation in withdrawFrom
Lines of code Vulnerability details Impact The FETH.withdrawFrom function does not validate its to parameter. Funds can be lost if to is the zero address. Similar issues have been judged as medium recently, see Sandclock M-15 / Github issue Recommended Mitigation Steps Check that to != 0. --- The...
No guard against zero address can possibly break functions with onlyOwner modifier
Handle jayjonah8 Vulnerability details Impact In XDEFIDistribution.sol the proposeOwnership function should check that the newOwner arg is not a zero address because one error can break every function in the contract that uses the onlyOwner modifier because if the owner is set to the zero address...
Previously created markets can be overwritten
Handle 0xRajeev Vulnerability details Impact The createMarket function allows accidental overwriting of previously created markets for the same combination of underlying and maturity timestamp u, m because there is no zero-address check to see if a previously created market exists for that...
Signature check passes for maker=0 orders
Handle cmichel Vulnerability details It's possible to choose the zero address for the maker of an order. Then any signature will pass the validOrderHash check. Impact This doesn't lead to any serious issues as the zero address does not have any approvals set of its own. The transactions will fail...
Card affiliate payouts are skipped if a single card does not have an affiliate
Handle cmichel Vulnerability details Vulnerability Details The Market.initialize function sets the cardAffiliateCut to zero if a single cardAffiliateAddresses is the zero address. for uint256 i = 0; i numberOfCards; i++ if cardAffiliateAddressesi == address0 cardAffiliateCut = 0; Impact Even if a...
DEBIAN-CVE-2020-26262
Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of 127.x.x.x. However, it was observed that when sending a CONNECT request with the XOR-PEER-ADDRESS value...
RTMPDump librtmp Remote Code Execution Vulnerability
RTMPDump is a toolkit for working with RTMP a network protocol used to transmit video and audio data over the Internet. librtmp is one of the libraries that supports the RTMP protocol. RTMPDump version 2.4 has a security vulnerability in the 'AMF3CDAddProp' function in the amf.c file in librtmp...
Linux kernel denial of service vulnerability (CNVD-2016-02787)
The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A denial of service vulnerability exists in the 'redirecttarget' function in the net/ipv4/netfilter/iptREDIRECT.c file in versions of Linux kernel prior to 2.6.0. A remote...
PT-2016-3458 · Linux +1 · Linux Kernel +1
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.0 Description: The issue allows remote attackers to cause a denial of service by sending packets to an interface with a 0.0.0.0 IP address. This is related to a NULL pointer dereference and OOPS in the...
qemu: slirp: NULL pointer deref in sosendto()
A NULL pointer dereference flaw was found in the way QEMU handled UDP packets with a source port and address of 0 when QEMU's user networking was in use. A local guest user could use this flaw to crash the guest...
