getActiveTickIndex returns wrong index

Lines of code Vulnerability details To find a tick that's above price ie its only underlying is the base token, getActiveTickIndex should not if baseTokenIsToken0 && amt0 == 0 || !baseTokenIsToken0 && amt0 == 0 return tickIndex; it should if baseTokenIsToken0 && amt1 == 0 || !baseTokenIsToken0 &&...

CVE-2023-4875

Null pointer dereference when composing from a specially crafted draft message in Mutt 1.5.2 2.2.12...

a3 Portfolio < 3.1.1 - Author+ Stored XSS

Description The plugin does not validate and escape some parameters, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks...

PT-2023-24843 · Unknown · Grandslambert Login Configurator

Name of the Vulnerable Software and Affected Versions: GrandSlambert Login Configurator plugin versions = 2.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin privileges can inject malicious scripts into th...

PT-2023-20543 · Tibco Software · Tibco Ebx Add-Ons

Name of the Vulnerable Software and Affected Versions: TIBCO EBX Add-ons versions 4.5.16 and below Description: The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an issue that allows an attacker with low-privileged application access to read system files that are accessible...

PT-2023-19101 · WordPress · Team With Slider

Name of the Vulnerable Software and Affected Versions: Sk. Abul Hasan Team Member – Team with Slider plugin versions = 4.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website...

Use of Telnet in multiple SICK Flexi Soft and Flexi Classic Gateways

Several versions of the SICK Flexi Soft Gateways FX0-GENT, FX0-GMOD, FX0-GPNT and SICK Flexi Classic Gateway UE410 provide a Telnet interface for debugging, which is enabled by factory default. No password is set in the default configuration. If the password is not set by the customer, a remote...

GitHub: Smuggling content in PR with refs/replace in GitHub

An incorrect comparison vulnerability was found in GitHub Enterprise Server, allowing commit smuggling through the display of an incorrect diff in the GitHub pull request UI. This vulnerability required write access to the repository and affected versions 3.7.0 and above. It was fixed in versions...

PT-2023-15073 · Themeisle · Themeisle Visualizer

Name of the Vulnerable Software and Affected Versions: Themeisle Visualizer: Tables and Charts Manager for WordPress plugin versions = 3.9.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher permissions. There is no...

PT-2023-18627 · Pixedelic.Com · Pixedelic.Com Camera Slideshow Plugin

Name of the Vulnerable Software and Affected Versions: Manuel Masia | Pixedelic.Com Camera slideshow plugin versions = 1.4.0.1 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into otherwise trusted websites,...

Malicious Package

Overview site-speed-above-the-fold-timer is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable i...

PT-2022-26445 · Miniorange · Miniorange'S Google Authenticator Plugin

Name of the Vulnerable Software and Affected Versions: miniOrange's Google Authenticator plugin versions = 5.6.1 Description: The issue is related to a Broken Access Control vulnerability. This vulnerability affects miniOrange's Google Authenticator plugin on WordPress, potentially allowing...

PYSEC-2022-43188

Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict unhandledRejection exiting AND using next start or a custom server...

CVE-2022-36046 Unexpected server crash in Next.js version 12.2.3

Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict unhandledRejection exiting AND using next start or a custom server...

PT-2022-21917 · Dell · Dell Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions 3.6.1 and below Description: The issue concerns a plain-text password storage vulnerability in the UI. An attacker with low privileges could potentially exploit this, leading to the disclosure of certain us...

PT-2022-22244 · Rizin · Rizin

Name of the Vulnerable Software and Affected Versions: Rizin versions 0.4.0 and below Description: The issue is related to an integer overflow via the function get long object. This allows attackers to cause a Denial of Service DoS via a crafted binary. Recommendations: For Rizin versions 0.4.0 a...

CVE-2022-26477

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

CVE-2022-1303

The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users such as editor and above to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

Kimai 安全漏洞

Kimai is an open source, web-based, multi-user time tracking application. A security vulnerability exists in Kimai 2 1.14, which is caused by the description in the new timetable...

GHSA-25MP-G6FV-MQXX Unexpected server crash in Next.js.

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom...