CVE-2020-26710

easy-parse v0.1.1 was discovered to contain a XML External Entity Injection XXE vulnerability which allows attackers to execute arbitrary code via a crafted XML file...

Cross site request forgery (csrf)

The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF...

AutoSwapThreshold field is not checked for exceeding MaxAutoSwapThreshold constant

Lines of code Vulnerability details Impact validateAutoSwapThreshold function has a problem that does not check the AutoSwapThreshold field is less than or equal to the MaxAutoSwapThreshold constant, this can caused that a malicious user could set the AutoSwapThreshold field to a value that is...

Open-Xchange AppSuite 代码问题漏洞

Open-Xchange AppSuite is a set of Web cloud desktop environments from Open-Xchange Germany. The environment allows users to manage email, tasks, files, etc. more intuitively. A code issue vulnerability exists in Open-Xchange App Suite that stems from the ability to inject serialized Java objects,...

Solon 代码问题漏洞

Solon is a new ecological application development framework for Java for noear individual developers in China. A code issue vulnerability exists in versions prior to Solon 2.3.3 that stems from allowing deserialization of untrusted data...

Google Android Code Problem Vulnerability (CNVD-2023-53158)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a code issue vulnerability that can be exploited by an attacker to cause a local elevation of privilege that requires no additional execute privileges...

Google Android Code Problem Vulnerability (CNVD-2023-53157)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a code issue vulnerability that can be exploited by an attacker to cause a local privilege escalation without the need for additional execute privileges...

CVE-2023-21128

In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

MAL-2023-666 Malicious code in packj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa234f9cd17f850d24031cd41a8370ad57596e538deb70be48d9fdea3fc4577a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

TMT Lockcell 代码问题漏洞

TMT Lockcell is an application from TMT Corporation. A code issue vulnerability exists in versions prior to TMT Lockcell 15, which stems from the fact that there is no limit to the number of uploads of a dangerous type of file, which can be exploited by an attacker to perform a command injection...

Matrix Synapse 代码问题漏洞

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A code issue vulnerability exists in Matrix Synapse versions prior to 1.85.0 that stems from the urlpreviewurlblacklist setting that can be bypassed via oEmbed or URL...

onlyEOA modifier can be bypassed and leads to loss of user funds(Openzeppelin removed isContract function check)

Lines of code Vulnerability details Impact The onlyEOA modifier is extensively used in L1 as well as L2 smart contracts. It is designed to restict certain operations to Externally Owned accountEOA. However, the vulnerability exist that may allow the malicious contract to bypass this restriction...

Captura 代码问题漏洞

Captura is a free and open source screen recording tool from the individual developer Mathew Sachin. A code issue vulnerability exists in Captura 8.0.0 and prior versions, which stems from faulty code in the library CRYPTBASE.dll that can lead to uncontrolled search paths...

Out-of-bounds

When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable. This vulnerability affects Firefox 111, Firefox ESR 102.9, and Thunderbird 102.9...

Changing _treasuryRate can cause lender to lose some interest that it is entitled to

Lines of code Vulnerability details Impact Calling the following ParticleExchange.buyNftFromMarket, ParticleExchange.repayWithNft, ParticleExchange.refinanceLoan, and ParticleExchange.auctionBuyNft functions accrue interestAccrued for the corresponding lender. When calling these functions, the...

CVE-2023-25752

When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable. This vulnerability affects Firefox 111, Firefox ESR 102.9, and Thunderbird 102.9...

rwar

Lines of code L1 Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps Assess...

PUB-A-216854451

In multiple functions of PasspointXmlUtils.java, there is a possible authentication misconfiguration due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Schneider Electric Modicon M580, Modicon M340 Code Issue Vulnerabilities

The Schneider Electric Modicon M580 is a programmable automation controller from Schneider Electric, France. A code issue vulnerability exists in the Schneider Electric Modicon M580 prior to version 4.10, Modicon M340 CPU prior to version 3.51, which can be exploited by an attacker to cause a...

[H1] Incorrect constant set at WhitePaperInterestRateModel

Lines of code Vulnerability details Impact Incorrect calculation of critical parameters like baseRatePerBlock. Proof of Concept The constant blocksPerYear is incorrectly set uint256 public constant blocksPerYear = 2102400; // @audit 15 seconds per block However, for Binance Smart Chain the blocks...