CVE-2023-35067

CVE-2023-35067 describes a plaintext password storage vulnerability in Infodrom Software E-Invoice Approval System. The issue allows reading sensitive strings from within an executable, effectively exposing password material if an attacker accesses the stored data. The vulnerability affects the E...

Infodrom Software E-Invoice Approval System 安全漏洞

Infodrom Software E-Invoice Approval System is an electronic invoice approval system from Infodrom Software, Turkey. A security vulnerability exists in Infodrom Software E-Invoice Approval System prior to version v.20230701, which stems from a plaintext stored password vulnerability that allows...

PT-2023-25122

Name of the Vulnerable Software and Affected Versions Infodrom Software E-Invoice Approval System versions prior to 20230701 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

CVE-2023-37290

InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and allowing an unauthenticated attackers to load remote or local resources through HTML tags such as iframe. This vulnerability allows...

CVE-2023-37290 InfoDoc Document On-line Submission and Approval System - Server-Side Request Forgery (SSRF)

InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and allowing an unauthenticated attackers to load remote or local resources through HTML tags such as iframe. This vulnerability allows...

CVE-2023-37290 InfoDoc Document On-line Submission and Approval System - Server-Side Request Forgery (SSRF)

InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and allowing an unauthenticated attackers to load remote or local resources through HTML tags such as iframe. This vulnerability allows...

CVE-2023-37290

InfoDoc Document On-line Submission and Approval System is affected by CVE-2023-37290 due to insufficient restrictions on HTML tags in its HTML-to-PDF conversion, enabling unauthenticated SSRF via resources loaded through tags like iframe. This could allow remote attackers to access arbitrary sys...

Design/Logic Flaw

It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in InfoDoc Document On-line Submission and Approval System, which allows an unauthenticated remote attacker can exploit this vulnerability without logging system to upload and run...

CVE-2023-37289 InfoDoc Document On-line Submission and Approval System - Arbitrary File Upload

It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in InfoDoc Document On-line Submission and Approval System, which allows an unauthenticated remote attacker can exploit this vulnerability without logging system to upload and run...

CVE-2023-37289

This CVE (CVE-2023-37289) affects InfoDoc Document On-line Submission and Approval System (versions 22547, 22567) and concerns an Unrestricted Upload of File with Dangerous Type in the file uploading function. The root cause is a permissive file upload mechanism that allows an unauthenticated rem...

Vault funds can be stolen by a malicious Yield Vault.

Lines of code Vulnerability details Impact When a vault is initialized, it sets Max Token Approval for the Yield Vault which allows the Yield Vault to ALWAYS have access to the funds in the vault. Since vaults can be created by anyone as long as they provide an ERC-4626 compliant yield source, an...

French Police Will Be Able to Spy on People through Their Cell Phones

The French police are getting new surveillance powers: French police should be able to spy on suspects by remotely activating the camera, microphone and GPS of their phones and other devices, lawmakers agreed late on Wednesday, July 5. … Covering laptops, cars and other connected objects as well ...

CVE-2023-37287

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes...

CVE-2023-37287

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes...

Multiple Plugins from Addify - Multiple CSRF

The plugins have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions addify-order-approval-woocommerce - To make a logged in admin approve the order with ID 103...

CVE-2023-37287

SmartBPM.NET (SmartBPM.NET) is affected by CVE-2023-37287 due to the use of a hard-coded authentication key. The vulnerability allows an unauthenticated remote attacker to access the system with regular user privileges, enabling reading of application data and execution of submission and approval...

CVE-2023-37287 SmartBPM.NET - Use of Hard-Coded Credentials - 2

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes...

In MulticallRootRouter.sol, approve function can fail for non standard ERC20 tokens like USDT

Lines of code Vulnerability details Impact Some tokens like USDT do not work when changing the allowance from an existing non-zero allowance value. For example Tether USDT’s approve function will revert if the current approval is not zero, to protect against front-running changes of approvals. Li...

Classified Ads Script 1.8 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

_newCastCount can overflow and lead to wrong state

Lines of code Vulnerability details Impact The method newCastCount only checks for overflow via the two parameters that are passed. If a user were to pass a quantity that is equal to typeuint128.max - currentCount + 1, they could effectively bring the newCastCount value to 0 or to any value they...