Insufficient oracle data feed validation

Lines of code Vulnerability details Impact Stale prices can lead to the incorrect valuation of assets Proof of Concept The code does not check the other data returned from latestRoundData which must be used to ensure that the data is not stale and that the price is valid File:...

Improper access control

An issue was discovered on Olivetti d-COLOR MF3555 2XDS000.002.271 devices. The Web Application is affected by Broken Access Control. It does not properly validate requests for access to data and functionality under the /mngset/authset path. By not verifying permissions for access to resources, i...

MISP 跨站脚本漏洞

MISP is an open source software solution. The product is used to collect, store, distribute, and share network security metrics and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerability exists in versions prior to MISP 2.4.158, which...

latestRoundData might return stale

Lines of code Vulnerability details Impact The conctract uses latestRoundData but there is no check if the returned value is stale data or not Proof of Concept code-423n4/2021-12-perennial-findings24 code-423n4/2021-06-tracer-findings73 Tools Used Manual analysis Recommended Mitigation Steps...

Improper Validation Of Chainlink's latestRoundData Function

Lines of code Vulnerability details Impact When using Chainlink Price feeds, it is important to ensure the price feed data was updated recently. While getting started with chainlink requires just one line of code, it is best to add additional checks for "in production" environments. Here,...

Should check return data from chainlink aggregators

Lines of code Vulnerability details Impact The refreshedAssetPerBaseInUQ function in the contract ChainlinkPriceOracle.sol fetches the asset price from a Chainlink aggregator using the latestRoundData function. However, there are no checks on roundID nor timeStamp, resulting in stale prices. The...

Citrix SD-WAN Cross-Site Scripting Vulnerability

Citrix SD-WAN is a networking product from Citrix, Inc. A cross-site scripting vulnerability exists in Citrix SD-WAN versions prior to 11.4.3a, which allows virtualization and optimization of enterprise site-to-site networks. The vulnerability stems from the program's lack of data validation...

Hotel-Mgmt-System Cross-Site Scripting Vulnerability

Hotel-Mgmt-System is a hotel management system. A cross-site scripting vulnerability exists in Hotel-Mgmt-System version 1.0, which stems from a lack of data validation filtering of user-supplied and output data in /admin.php. An attacker could exploit this vulnerability to execute JavaScript cod...

CMSimple Cross-Site Scripting Vulnerability (CNVD-2022-71403)

CMSimple is a free content management system. version 5.4 of CMSimple contains a cross-site scripting vulnerability that stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to execute JavaScript code on the clie...

REDCap Cross-Site Scripting Vulnerability (CNVD-2022-81345)

A cross-site scripting vulnerability exists in versions of REDCap prior to 11.4.0, which stems from a lack of data validation filtering of user-supplied data and output in the missing data code functionality of the program. An attacker could exploit this vulnerability to execute JavaScript code o...

Organizr Cross-Site Scripting Vulnerability (CNVD-2022-33830)

Organizr is a tab management system. Organizr 2.1.1810 prior versions of cross-site scripting vulnerability, the vulnerability stems from the Username and Email fields lack of data provided by the user and the output data validation filter, an attacker can use the vulnerability in the client to...

Hotel-Mgmt-System 跨站脚本漏洞

Hotel-Mgmt-System is a hotel management system. A cross-site scripting vulnerability exists in Hotel-Mgmt-System version 1.0, which stems from a lack of data validation filtering of user-supplied and output data in /admin.php. An attacker could exploit this vulnerability to execute JavaScript cod...

REDCap 跨站脚本漏洞

A cross-site scripting vulnerability exists in versions of REDCap prior to 11.4.0, which stems from a lack of data validation filtering of user-supplied data and output in the missing data code functionality of the program. An attacker could exploit this vulnerability to execute JavaScript code o...

Citrix SD-WAN 跨站脚本漏洞

Citrix SD-WAN is a networking product from Citrix, Inc. A cross-site scripting vulnerability exists in Citrix SD-WAN versions prior to 11.4.3a, which allows virtualization and optimization of enterprise site-to-site networks. The vulnerability stems from the program's lack of data validation...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to insufficient input data validation, allows a hacker to trigger a service failure.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause service failures...

HPE OneView Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in versions prior to HPE OneView 6.6, which stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could use this vulnerability to execute JavaScript code on the client side...

Rumble Mail Server Cross-Site Scripting Vulnerability

Rumble Mail Server is a mail server suite for SMTP ESMTPSA, HTTP, POP3 and IMAP4v1 by Daniel Gruno, a personal developer.A cross-site scripting vulnerability exists in Rumble Mail Server version 0.51.3135, which stems from the username parameter's lack of data validation filtering for user The...

Rumble Mail Server Cross-Site Scripting Vulnerability (CNVD-2022-63575)

Rumble Mail Server is a mail server suite for SMTP ESMTPSA, HTTP, POP3, and IMAP4v1 from Daniel Gruno's personal developer.Rumble Mail Server version 0.51.3135 is vulnerable to a cross-site scripting vulnerability that stems from the servername parameter lacks a data validation filter for...

Rumble Mail Server Cross-Site Scripting Vulnerability (CNVD-2022-63573)

Rumble Mail Server is a mail server suite for SMTP ESMTPSA, HTTP, POP3, and IMAP4v1 from Daniel Gruno's personal developer.Rumble Mail Server version 0.51.3135 is vulnerable to a cross-site scripting vulnerability that stems from the domain and path parameters are missing a data validation filter...

Directus Cross-Site Scripting Vulnerability (CNVD-2022-81371)

Directus is a live Api and application dashboard. Used to manage Sql database content, a cross-site scripting vulnerability existed prior to Directus version 9.7.0, which stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this...