CVE-2023-22452

CVE-2023-22452 affects the Discord bot kenny2automate . The vulnerability is in the web interface for server settings where input names embedded Discord channel IDs, with no validation to confirm the IDs belong to the target server before commit a947d7c. This enables an attacker who has access to...

CVE-2023-22452 Improper Input Validation in kenny2automate

kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior to commit a947d7c, no validation was performed to ensure that the channel IDs submitted actually belonged to the server being configured...

kenny2automate 输入验证错误漏洞

kenny2automate is a small Discord bot by the individual developers at AbyxDev. An input validation error vulnerability exists in previous versions of kenny2automate a947d7c, which stems from a failure to perform validation to ensure that the submitted channel ID actually belongs to the server bei...

PT-2023-18508 · Unknown · Kenny2Automate

Name of the Vulnerable Software and Affected Versions: kenny2automate versions prior to commit a947d7c Description: The issue concerns a Discord bot where form elements in the web interface for server settings were generated with Discord channel IDs as part of input names. No validation was...

New GoTrim Botnet Attempting to Break into WordPress Sites' Admin Accounts

A new Go-based botnet has been spotted scanning and brute-forcing self-hosted websites using the WordPress content management system CMS to seize control of targeted systems. "This new brute forcer is part of a new campaign we have named GoTrim because it was written in Go and uses ':::trim:::' t...

PT-2022-28230 · Unknown · Candy Machine V2

Name of the Vulnerable Software and Affected Versions: Candy Machine V2 Description: A problem with Candy Machine V2 allows minting NFTs to an arbitrary collection due to a missing check. The issue can be exploited through a specific transaction sequence, involving two instructions. The first...

user can loose ETH when using Router::multicall

Lines of code Vulnerability details Impact When using Router multicall function user must not forgot to append to the multicall data array calls for unwrapWETH9 or refundETH. If the user forgets to do this a MEV bot can see the missed tokens and take them out because anyone can call the mentioned...

Code injection

Mastodon through 4.0.2 allows attackers to cause a denial of service large Sidekiq pull queue by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated message...

Mastodon 安全漏洞

Mastodon is an open source social networking server based on ActivityPub. A security vulnerability exists in Mastodon 4.0.2 and prior versions, which stems from a vulnerability that allows an attacker to cause a denial of service long Sidekiq pull queue by creating a bot account that follows an...

CVE-2022-46405

Mastodon through 4.0.2 allows attackers to cause a denial of service large Sidekiq pull queue by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated message...

PT-2022-27857 · Mastodon · Mastodon

Name of the Vulnerable Software and Affected Versions: Mastodon versions through 4.0.2 Description: The issue allows attackers to cause a denial of service by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, resulting...

CVE-2022-46405

CVE-2022-46405 affects Mastodon up to version 4.0.2. The issue enables denial-of-service by creating bot accounts that follow attacker-controlled accounts on servers with a wildcard DNS A record, causing uncontrolled recursion of attacker-generated messages and an enlarged Sidekiq pull queue. Aff...

CVE-2022-46405

Mastodon through 4.0.2 allows attackers to cause a denial of service large Sidekiq pull queue by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated message...

Malicious code in bot-discord-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55ffb74a9245e6811c04b9da8a085e52cd7fdea7847732afe923644e256d99c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1656 Malicious code in bot-discord-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55ffb74a9245e6811c04b9da8a085e52cd7fdea7847732afe923644e256d99c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Native funds on the aggregator contract balance is a free grab

Lines of code Vulnerability details Native funds on the aggregator contract balance is a free grabLooksRareAggregator's execute returns the native balance of the contract to the caller even when nothing was provided with the call. This happens when LooksRareAggregator's execute is called directly...

Amadey Bot Spotted Deploying LockBit 3.0 Ransomware on Hacked Machines

The Amadey malware is being used to deploy LockBit 3.0 ransomware on compromised systems, researchers have warned. "Amadey bot, the malware that is used to install LockBit, is being distributed through two methods: one using a malicious Word document file, and the other using an executable that...

Robin Banks Phishing Service for Cybercriminals Returns with Russian Server

A phishing-as-a-service PhaaS platform known as Robin Banks has relocated its attack infrastructure to DDoS-Guard, a Russian provider of bulletproof hosting services. The switch comes after "Cloudflare disassociated Robin Banks phishing infrastructure from its services, causing a multi-day...

Rising Bot Attacks – Why is Your Organization Struggling to Deal with Them?

By Waqas Bot attacks rose by 41% in H1 2021, with the financial services and media industries facing the highest proportion… This is a post from HackRead.com Read the original post: Rising Bot Attacks – Why is Your Organization Struggling to Deal with Them?...

Design/Logic Flaw

Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel and bypass raid and webhook protection...