3287 matches found
PT-2023-19945 · Teampass · Teampass
Name of the Vulnerable Software and Affected Versions: teampass versions prior to 3.0.7 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation, allowing attackers to inject maliciou...
Upgraded Q -> 3 from #635 [1683219244120]
Judge has assessed an item in Issue 635 as 3 risk. The relevant finding follows: Unsafe downcasting PrivatePool.sol - 230, 231 --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 3 from #13 [1683219131959]
Judge has assessed an item in Issue 13 as 3 risk. The relevant finding follows: L-6 Consider using OpenZeppelin’s SafeCast library to prevent unexpected errors 3 --- The text was updated successfully, but these errors were encountered: 👍 1 sathishpic22 reacted with thumbs up emoji All reactions 👍...
Upgraded Q -> 2 from #225 [1683100933057]
Judge has assessed an item in Issue 225 as 2 risk. The relevant finding follows: uint256 exponent = baseToken == address0 ? 18 - 4 : ERC20baseToken.decimals - 4; will revert since ERC20baseToken.decimals - 4; causes an underflow --- The text was updated successfully, but these errors were...
Cross-Site Scripting (XSS)
nilsteampassnet/teampass is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in the item description field which allows an attacker to inject and execute arbitrary JavaScript into the browser...
Upgraded Q -> 2 from #882 [1683052816154]
Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: If royaltyFee 0 and recipient == address0 users will be overcharged --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #882 [1683052810426]
Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: Attacker can front-run create to steal tokens sent to predetermined address --- The text was updated successfully, but these errors were encountered: All reactions...
PT-2023-18773 · Sourcecodester · Sourcecodester Purchase Order Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Purchase Order Management System version 1.0 Description: A problematic issue has been found in the system, affecting an unknown part of the file classes/Master.php?f=save item. The manipulation of the description argument with...
CVE-2023-29849
Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice, menuID, staffID, or itemqty parameter...
Code injection
Stargate-Bukkit is a mod for the minecraft video game which adds a portal focused environment. In affected versions Minecarts with chests will drop their items when teleporting through a portal; when they reappear, they will still have their items impacting the integrity of the game world. The...
CVE-2023-30532
A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository...
CVE-2023-30522
A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobs specified in a 'jobname' request parameter...
CVE-2023-30532
A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository...
PT-2023-22751 · Jenkins · Jenkins Report Portal Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Report Portal Plugin versions 0.5 and earlier Description: The Jenkins Report Portal Plugin stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These tokens can...
PT-2023-22761 · Jenkins · Jenkins Turboscript Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins TurboScript Plugin versions 1.3 and earlier Description: A missing permission check in the plugin allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository. Recommendations...
Upgraded Q -> 2 from #163 [1681245765448]
Judge has assessed an item in Issue 163 as 2 risk. The relevant finding follows: Attacker can use malicious BioText --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #219 [1681246395864]
Judge has assessed an item in Issue 219 as 2 risk. The relevant finding follows: Emojis split in different lines --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 3 from #74 [1679875886032]
Judge has assessed an item in Issue 74 as 3 risk. The relevant finding follows: Exchange Rate can be manipulated if positions are big enough for a long enough time --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #179 [1679871876484]
Judge has assessed an item in Issue 179 as 2 risk. The relevant finding follows: L-14 Lack of access control in setVault function leave it vulnerable to frontrunning attack --- The text was updated successfully, but these errors were encountered: All reactions...