Assets from the old step are not properly transferred to a new TR position

Lines of code Vulnerability details Impact The transferAssetsIntoStep function's intent is to serve two purposes: transferring aAssets to a target TR position and moving assets from an old step to a target TR position. However, in practice, assets removed from the old step are not integrated into...

Unauthorized Access to Critical Functions in Smart Contract

Lines of code Vulnerability details Description The provided smart contract contains critical functions, such as close, closeDebt, and withdrawOptionAssets, that can be called by any external address without proper authentication or authorization checks. This lack of access control exposes the...

GHSA-W3QM-93VF-5HRW Cockpit Cross-site Scripting vulnerability

Cross-site Scripting XSS - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. For any role that has permission to execute function assets, an attacker can upload a html file and that leads to XSS...

Cross-site Scripting (Stored XSS)

Description For any role that has permission to execute function assets, i can upload a html file and that leads to XSS. Proof of Concept 1. Link PoC: https://docs.google.com/document/d/1pZAi6PZiBmN3yNsBmY8Z9Qd3hv-8zPHUh69h-i1rvA/edit?usp=sharing 2. Link video PoC:...

TOFT in (m)TapiocaOft contracts can be stolen by calling removeCollateral() with a malicious removeParams.market

Lines of code Vulnerability details Impact The TOFT available in the TapiocaOFT contract can be stolen when calling removeCollateral with a malicious market. Proof of Concept mTapiocaOFT inherit BaseTOFT, which has a function removeCollateral that accepts a market address as an argument. This...

cbETH's fails to check for a depeg since pegPrice is always 1

Lines of code Vulnerability details Whenever refresh is called for a collateral it does a few checks, one of them is to ensure the collateral didn't depge. It does so by calling tryPrice and checking that the returned parameter pegPrice which is supposed to represent the current price of the...

Cross-site Scripting (Stored XSS)

Description For any role that has permission to execute function assets, i can add a new asset. Even though the site only allows uploading images and gifs, I can still upload an html file by modifying the magic number and that leads to XSS. Proof of Concept 1. Link PoC:...

Potential Early Exploit in Morho-Aave ERC4626 Implementation

Lines of code Vulnerability details Impact The issue discovered can be exploited when a vault is initially empty. A malicious actor could frontrun a legitimate user's deposit, contributing a negligible amount to the vault. This allows the actor to own shares while the total asset in the vault is...

Risk Fact #1: Cloud Migration Exploitation Cloud Security Research Risk Fact

Qualys Blog Series – 2023 TotalCloud Security Insights by the Threat Research Unit The 2023 TotalCloud Security Insights report from the Qualys Threat Research Unit TRU provides research insights, best practices, and detailed recommendations organized by five separate Risk Facts. The insights wil...

THERE IS NO FUNCTIONALITY TO LIQUIDATE THE DEPRECATED MTOKEN MARKETS

Lines of code Vulnerability details Impact The Mtoken markets configured for the respective collateral asset types can get deprecated due to various reasons associated with those assets. There should be functionality in the Comptroller.liquidateBorrowAllowed function to liquidate all the borrows ...

Perch v3.2 - Persistent Cross Site Scripting (XSS)

Exploit Title: Perch v3.2 - Persistent Cross Site Scripting XSS Google Dork: N/A Date: 23-July-2023 Exploit Author: Dinesh Mohanty Vendor Homepage: https://grabaperch.com/ Software Link: https://grabaperch.com/download Version: v3.2 Tested on: Windows CVE : Requested Description: Stored Cross Sit...

Boom CMS Cross-Site Scripting Vulnerability

Boom CMS is a website builder from Boom CMS in the UK. Boom CMS version 8.0.7 suffers from a cross-site scripting vulnerability, which stems from the lack of effective filtering and escaping of user-supplied data in the title/description parameter of the assets-manager component, which can be...

About the security content of macOS Ventura 13.5

About the security content of macOS Ventura 13.5 This document describes the security content of macOS Ventura 13.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

Boom CMS v8.0.7 - Cross Site Scripting Vulnerability

Exploit Title: Boom CMS v8.0.7 - Cross Site Scripting Product & Service Introduction: =============================== Boom is a fully featured, easy to use CMS. More than 10 years, and many versions later, Boom is an intuitive, WYSIWYG CMS that makes life easy for content editors and website...

Perch v3.2 - Remote Code Execution Exploit

Exploit Title: Perch v3.2 - Remote Code Execution RCE Application: Perch Cms Version: v3.2 Bugs: RCE Technology: PHP Vendor URL: https://grabaperch.com/ Software Link: https://grabaperch.com/download Date of found: 21.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC...

Perch v3.2 - Remote Code Execution (RCE)

Exploit Title: Perch v3.2 - Remote Code Execution RCE Application: Perch Cms Version: v3.2 Bugs: RCE Technology: PHP Vendor URL: https://grabaperch.com/ Software Link: https://grabaperch.com/download Date of found: 21.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC...

CVE-2023-3790

A vulnerability has been found in Boom CMS 8.0.7 and classified as problematic. Affected by this vulnerability is the function add of the component assets-manager. The manipulation of the argument title/description leads to cross site scripting. The attack can be launched remotely. The exploit ha...

Cross site scripting

A vulnerability has been found in Boom CMS 8.0.7 and classified as problematic. Affected by this vulnerability is the function add of the component assets-manager. The manipulation of the argument title/description leads to cross site scripting. The attack can be launched remotely. The exploit ha...

CVE-2023-3790 Boom CMS assets-manager add cross site scripting

A vulnerability has been found in Boom CMS 8.0.7 and classified as problematic. Affected by this vulnerability is the function add of the component assets-manager. The manipulation of the argument title/description leads to cross site scripting. The attack can be launched remotely. The exploit ha...

Boom CMS 跨站脚本漏洞

Boom CMS is a website builder from Boom CMS in the UK. Boom CMS version 8.0.7 suffers from a cross-site scripting vulnerability, which stems from the lack of effective filtering and escaping of user-supplied data in the title/description parameter of the assets-manager component, which can be...