Cross-Site Request Forgery (CSRF) in neorazorx/facturascripts

✍️ Description Attacker able to delete any number of Accounting Reports with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your...

Incorrect shift variable is reset in LongShort

Handle shw Vulnerability details Impact The logic at lines 1187 to 1208 of LongShort is to handle the user's shift from SHORT to LONG. However, at line 1207, the number of tokens to be shifted from LONG is reset to 0 instead of SHORT, causing incorrect accounting of LONG and SHORT tokens. Proof o...

kernel security, bug fix, and enhancement update

4.18.0-305.12.14.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

Akaunting Cross-Site Scripting Vulnerability (CNVD-2021-94938)

Akaunting is a free, open source online accounting software designed for small businesses and freelancers. akaunting 2.1.12 and earlier versions contain a persistent cross-site scripting vulnerability when processing user-supplied avatar images. An attacker could exploit the vulnerability to inse...

Akaunting authentication bypass vulnerability

Akaunting is a free, open source online accounting software designed for small businesses and freelancers.An authentication bypass vulnerability exists in the user-controllable field companies0 in Akaunting 2.1.12 and earlier versions. No detailed vulnerability details are currently available...

Akaunting 安全漏洞

Akaunting is a free, open source online accounting software designed for small businesses and freelancers.An authentication bypass vulnerability exists in the user-controllable field companies0 in Akaunting 2.1.12 and earlier versions. No detailed vulnerability details are currently available...

Payout.deduction computation uses wrong decimals

Handle cmichel Vulnerability details The doSherX function computes the burned SherX tokens deduction as: // excludeUsd = amountsi.mulsx.tokenUSDtokensi deduction = excludeUsd.divcurTotalUsdPool.divSherXERC20Storage.sx20.totalSupply.div10e17; This seems to only work if tokensi has 18 decimals, as...

OTRS Cross-Site Scripting Vulnerability (CNVD-2021-57225)

OTRS is an application of the German company OTRS. A cross-site scripting vulnerability exists in OTRS AG Time Accounting, which stems from the ability to inject malicious JS code into specific fields during the project creation screen. No details of the vulnerability are currently available...

SUSE-SU-2021:2473-1 Security update for slurm

This update for slurm fixes the following issues: Updated to 20.11.7 Summary of new features: CVE-2021-31215: Fixed a remote code execution as SlurmUser bsc1186024. slurmd - handle configless failures gracefully instead of hanging indefinitely. select/constres - fix Dragonfly topology not selecti...

CVE-2021-21442

In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19...

CVE-2021-21442

In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19...

Code injection

In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19...

CVE-2021-21442 XSS vulnerability in Time Accounting

In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19...

CVE-2021-21442

CVE-2021-21442 describes a cross-site scripting (XSS) vulnerability in OTRS Time Accounting. The issue allows injecting malicious JavaScript into fields on the project creation screen, with potential execution in the Reporting screen. Affected product: OTRS Time Accounting 7.0.x prior to 7.0.19. ...

Tianjin Shenzhou Haotian Technology Co., Ltd. online self-service accounting system has logic flaws vulnerability

Tianjin Shenzhou Haotian Technology Co., Ltd. is a high-tech enterprise integrating management software design, development, sales and service. Tianjin Shenzhou Haotian Technology Co., Ltd. online self-service reporting system has a logic flaw vulnerability, attackers can use the vulnerability to...

SQL Injection Vulnerability in Online Self-service Accounting System of Tianjin Shenzhou Haotian Technology Co.

The online self-service reporting system is a financial management system that automates the reporting of accounts. There is a SQL injection vulnerability in the Online Self-service Account Reporting System of Tianjin Shenzhou Haotian Technology Co., Ltd, which can be exploited by attackers to...

Duplication of Balance

Handle 0xsomeone Vulnerability details Impact It is possible to duplicate currently held ink or art within a Cauldron, thereby breaking the contract's accounting system minting units out of thin air. Proof of Concept The stir function of the Cauldron, which can be invoked via a Ladle operation,...

Changing ERC20ConvictionScore.governanceThreshold leads to temporarily broken state

Handle cmichel Vulnerability details Vulnerability Details Changing the governanceThreshold breaks the governance credit score accounting as users who currently qualify for being a governor may not qualify anymore and this influences the quorum threshold. It can be changed using...

Incorrect use of _addTribute instead of _addGovernanceTribute

Handle 0xRajeev Vulnerability details Impact The addRegistrationTributeGovernance function is called by the FSD network to update tribute when 7.5% is contributed towards governance as part of purchaseMembership. However, this function incorrectly calls addTribute as done in addRegistrationTribut...

[SECURITY] Fedora 33 Update: slurm-20.11.7-1.fc33

Slurm is an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for Linux clusters. Components include machine status, partition management, job management, scheduling and accounting modules...