Malicious code in asset-detect-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63f1bed965e937f905874b40b1b84c950a88fa75f246b833c791ffef97a1cf34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in asset-detect-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 604f819f0f5b6ab645d72fac4c1463c58bb06d5becbe0f97465ee7001b1c5e4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1140 Malicious code in asset-detect-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 604f819f0f5b6ab645d72fac4c1463c58bb06d5becbe0f97465ee7001b1c5e4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in asset-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e43ea20378699b2764a883d2aca54c05dc083fc73fb3aee346d7415675ec3d0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1138 Malicious code in asset-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e43ea20378699b2764a883d2aca54c05dc083fc73fb3aee346d7415675ec3d0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2040 Malicious code in com.innogames.asset-relations-viewer-addressables (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81ae03950b09c854e3888fb0f69bec9fab0b81bd98f06e7c522bff8dda778b03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @instant-api-hooks/assethub-campaigns (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3cd0ffbe2349da7aea9f042d99b1fc38ec727b62ded2bee52f82d613acfc9f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in asset-bender (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d50ae37728da118ce8c2f753efbaff3679ef4fb0fbdc96b107f104403a8eca8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1137 Malicious code in asset-bender (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d50ae37728da118ce8c2f753efbaff3679ef4fb0fbdc96b107f104403a8eca8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in asset-fingerprinting-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c1c0a99e0753467b4c5a95ca704c71d27d1e3bf291a7a7ab12b6d8d7fcc6624 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1141 Malicious code in asset-fingerprinting-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c1c0a99e0753467b4c5a95ca704c71d27d1e3bf291a7a7ab12b6d8d7fcc6624 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Round down in previewWithdraw() may result in withdrawing asset using zero share.

Lines of code Vulnerability details Impact In wfCashERC4626.previewWithdraw function, when fCash has matured, shares is calculated using convertToShares. But convertToShares function rounded down in division. This may lead to the case that user can use zero share to withdraw asset. It has been...

CVE-2021-25116

The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the removeasset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put...

Cross site request forgery (csrf)

The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the removeasset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put...

PT-2022-9671 · WordPress · Enqueue Anything

Name of the Vulnerable Software and Affected Versions: Enqueue Anything WordPress plugin versions 1.0.0 through 1.0.1 Description: The issue is related to the lack of authorization and CSRF checks in the remove asset AJAX action. This allows low-privilege users, such as subscribers, to delete...

WordPress plugin Enqueue Anything 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Re-entrancy in wfCashERC4626.withdraw() can lead to more gains in assets

Lines of code Vulnerability details This is a corrected version of the previous submission and typo mistakes corrected. Impact The withdraw function in wfCashERC4626.sol can be re-entered at the point of redeemInternal. Assume asset tokens are sent to receiver after shares are burnt, and user...

Re-entrancy in wfCashERC4626.redeem() can lead to more gains in assets and/or shares

Lines of code Vulnerability details Impact The redeem function in wfCashERC4626.sol can be re-entered at the point of redeemInternal. Assume underlying tokens are sent to receiver after shares are burnt, and user re-enters redeem after redeemInternal is completed., P.S: there's a separate issue o...

wfCashERC4626.withdraw() missing some asset balance checks and calculations can drain contract

Lines of code Vulnerability details Impact The withdraw function in wfCashERC4626.sol has no check for asset token balanceOf and calculations before and after transfer. With this, a user can keep calling withdraw multiple times and keep gaining more assets. Proof of Concept 1. Assume redeemIntern...

GLPI SQL Injection Vulnerability (CNVD-2022-68953)

GLPI is an IT and asset management software. The software provides a full-featured IT resource management interface that can be used to create a database to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridges and ink cartridges, etc. A SQL...