CVE-2023-43144

Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php...

Sql injection

Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php...

Projectworldsl Assets-management-system-in-php SQL Injection Vulnerability

Assets-management-system-in-php is a PHP asset management system for projectworlds individual developers. A security vulnerability exists in Projectworldsl Assets-management-system-in-php version 1.0, which stems from a SQL injection vulnerability in the parameter id of the file delete.php...

CVE-2023-43144

Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php...

CVE-2023-43144

CVE-2023-43144 affects the Projectworldsl Assets-management-system-in-php 1.0. The issue is a SQL Injection in delete.php via the id parameter, where the value is directly interpolated into a query without validation or sanitization, enabling arbitrary SQL execution. Connected sources (Red Hat, N...

PT-2023-28716

Name of the Vulnerable Software and Affected Versions Projectworldsl Assets-management-system-in-php version 1.0 Description The issue is related to SQL Injection via the id parameter in the "delete.php" endpoint. This allows for potential exploitation. Recommendations For Projectworldsl...

CVE-2023-43144: Improper Neutralization of Special Elements used in an SQL Command

Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php...

Upgraded Q -> 2 from #506 [1695291399781]

Judge has assessed an item in Issue 506 as 2 risk. The relevant finding follows: L‑01 The admin wont be able to burn rUSDY if the address is blacklisted/sanctioned and not on the allowlist The burn function in rUSDY.sol allows the admin to seize rUSDY if the user is not legally allowed to own it...

Wallarm Webinar: NIST CSF 2.0, API Security, and CISO Imperatives

Last week, our good friend Raj Umadas, Director of Security at ActBlue, teamed up with our very own Tim Erlin, Head of Product, to talk about the newly proposed NIST Cybersecurity Framework CSF. It was a fantastic discussion covering the intent behind this update, the major changes from v1.1 to...

CVE-2023-41042 Discourse DoS via remote theme assets

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to HTTP header injection due to Go CVE-2023-29406

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to HTTP header injection due to Go CVE-2023-29406 with details below. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2023-29406 DESCRIPTION: Golang Go is vulnerable to HTTP head...

Blocking assets/shares in escrow

Lines of code Vulnerability details Impact An investor can lose a part of assets or shares due to their blocking in escrow. Proof of Concept Suppose the user decided to invest an amount of assets which is more than typeuint128.max. This can be done by calling the requestDeposit function several...

Assumptions are currently made that prices would forever be positive

Lines of code Vulnerability details Impact Neglecting the potential for negative asset prices can lead to inaccurate value representation in the Liquidity Pool, possibly affecting calculations related to assets and tokens. It's crucial to note that the value of an asset, even if negative in the...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Node.js CVE-2022-25883

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Node.js CVE-2022-25883 with details below. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2022-25883 DESCRIPTION: Node.js semver package is vulnerabl...

PT-2023-7509 · Atlassian +1 · Confluence +1

Name of the Vulnerable Software and Affected Versions: Apache Struts versions prior to 2.5.32 Apache Struts versions prior to 6.1.2.2 Apache Struts versions prior to 6.3.0.1 Confluence Data Center versions from 7.17.0 to 8.8.0 excluding 8.8.0 Confluence Data Center versions from 8.0.0 to 8.0.4...

An attacker can use the flashloan() function without real collateral assets

Lines of code Vulnerability details Impact Function flashloan - allows delegate token owner or approved operator to borrow their underlying tokens for the duration of a single atomic transaction. The function uses Structs.FlashInfo calldata info as an input parameter. However, some parameters fro...

An attacker can steal assets due to an incorrect revertInvalidWithdrawalConditions check in DelegateToken.withdraw()

Lines of code Vulnerability details Impact Function withdraw - allows principal rights owner or approved operator to withdraw the underlying token once the delegation rights have either met their expiration or been rescinded. To withdraw assets, a check is made that the assets are being withdrawn...

User will loss his funds forever if Threshold are not met .

Lines of code Vulnerability details Impact mintIfThresholdMet function is called from execute function while executing a bridging transaction . This function checks if thresholds are met and only mints token in the destination chain to the user if thresholds are met properly . However , the probl...

Zero Redemption Amount in RdpxDecayingBonds Contract

Lines of code Vulnerability details Impact The redeem function, as described, checks whether the assets to be redeemed assets are not zero. This check is in place to ensure that a user isn't redeeming a non-zero amount of rdpxAmount tokens in exchange for zero assets. Such a check is essential to...

Way Too Vulnerable: Join this Webinar to Understand and Strengthen Identity Attack Surface

In today's digital age, it's not just about being online but how securely your organization operates online. Regardless of size or industry, every organization heavily depends on digital assets. The digital realm is where business takes place, from financial transactions to confidential data...