PT-2024-28450 · Aimeos · Ai-Controller-Frontend

Name of the Vulnerable Software and Affected Versions: aimeos/ai-controller-frontend versions prior to 2024.04.2 aimeos/ai-controller-frontend versions prior to 2023.10.9 aimeos/ai-controller-frontend versions prior to 2022.10.8 aimeos/ai-controller-frontend versions prior to 2021.10.8...

RTokenAsset price estimation accounts for margin of error twice

Lines of code Vulnerability details RTokenAsset estimates the price by multiplying the BU basket unit price estimation by the estimation of baskets held then dividing by total supply. The issue is that both BU and baskets held account for price margin of error, widening the range of the price mor...

The vulnerability of the filter() and basket() functions in the Ajax Controller of the PNP4Nagios performance monitoring system for network monitoring allows a violator to execute cross-site scripting attacks.

The vulnerability of the filter and basket functions in the Ajax Controller of the PNP4Nagios performance monitoring system for network monitoring involves a lack of measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker to perform cross-site...

CVE-2023-38350

PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26...

CVE-2023-38350

PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26...

Cross site scripting

PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26...

CVE-2023-38350

PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26...

PNP4Nagios 跨站脚本漏洞

PNP4Nagios is a plugin for the PNP4Nagios project. A security vulnerability exists in PNP4Nagios version 0.6.26 that stems from stored cross-site scripting in the basket API and filters in the AJAX controller...

CVE-2023-38350

CVE-2023-38350 affects PNP4Nagios (versions 0.6.26 through 81ebfc5) where stored XSS exists in the AJAX controller via the basket API and filters. The issue is caused by insufficient input handling in the affected AJAX endpoints, enabling cross-site scripting. Affected components are the web inte...

CVE-2023-38350

PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26...

PT-2023-3898 · Unknown · Pnp4Nagios

Name of the Vulnerable Software and Affected Versions: PNP4Nagios versions 0.6.26 through 81ebfc5 Description: The issue is related to stored XSS in the AJAX controller via the basket API and filters. This can be exploited by a remote attacker to perform cross-site scripting attacks. The...

StRSR.withdraw can be blocked

Lines of code Vulnerability details Impact StRSR.withdraw can be blocked for user by changing basket's asset to IFFY status. User will not be able to withdraw and his funds can be seized later. Proof of Concept StRSR.withdraw function allows user to withdraw only, when basketHandler.isReady. And...

AssetRegistry.swapRegistered can be called with low gas to make basket be disabled

Lines of code Vulnerability details Impact Attacker can disable basket, when swapping or unregistering not basket asset. Proof of Concept AssetRegistry.swapRegistered and AssetRegistry.unregister are both functions that can be called by governance only. It's possible that after proposal is passed...

Attacker can disable basket during un-registration, which can cause an unnecessary trade in some cases

Lines of code Vulnerability details At the mitigation contest there was an issue regarding the basketHandler.quantity call at the unregistration process taking up all gas. As a mitigation to that issue the devs set aside some gas and use the remaining to do that call. This opens up to a new kind ...

Redemptions during undercollateralization can be hot-swapped to steal all funds

Lines of code Vulnerability details Impact During recollateralization/a switch basket/when the protocol collateral isn't sound, a user can have almost their entire redemption transaction hot swapped for nothing. For example, trying to redeem 1M collateral for 1M rTokens could have the user end up...

RecollateralizationLib: Flaw in basket range calculation leads to early basket compromise and loss to RToken holders

Lines of code Vulnerability details Impact This report deals with how the recollateralization algorithm underestimates the number of baskets it can hold by calculating unnecessary costs for collateral that does not need to be traded. When this number of baskets it thinks it can hold is reached -...

Basket range formula is inefficient, leading the protocol to unnecessary haircut

Lines of code Vulnerability details Impact The BackingManager.manageTokens function checks if there's any deficit in collateral, in case there is, if there's a surplus from another collateral token it trades it to cover the deficit, otherwise it goes for a 'haircut' and cuts the amount of basket...

@basket/get (>=1.1.0 <=1.2.2), @bitovi/incremental (>=1.0.0 <=1.0.2) +50 more potentially affected by CVE-2022-37257 via steal (>=0.12.9 <=2.3.0)

steal NPM version =0.12.9, =1.1.0, =1.0.0, =1.0.0, =0.0.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1-0, =0.3.0, =1.0.0, =0.4.0, =0.7.3 and more Source cves: CVE-2022-37257 Source advisory: OSV:GHSA-93Q5-3XPC-8VG3...

Malicious Basket Could Be Used To Rug Fractionalized Token Holders

Lines of code Vulnerability details Proof-of-Concept The NibblVaultFactory.createVault accepts any NFT address or any Basket address. Therefore, an attacker could pass a malicious basket address during vault creation. function createVault address assetAddress, address curator, string memory name,...

Owner of the BasketFacet can cause DoS for exitPool(...) function

Handle Czar102 Vulnerability details Impact Provided an owner can add any tokens to the basket, it may add a token, for which the owner can burn tokens from any account. Then, after adding the token to the basket, the owner may burn tokens so that token.balanceofBasketFacet will be below MINAMOUN...