WordPress Product Price History for WooCommerce Plugin < 2.1.6 is vulnerable to Cross Site Scripting (XSS)

Software Product Price History for WooCommerce Type Plugin Vulnerable versions 2.1.6 Fixed in 2.1.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f6582974ed46 Credits Rafie Muhamm...

WordPress Change Price Title for WooCommerce Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software Change Price Title for WooCommerce Type Plugin Vulnerable versions = 2.3 Fixed in 2.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 363a9547c8ad Credits Rafie Muhammad...

WordPress Price Bands for WooCommerce Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Price Bands for WooCommerce Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 59c757fed82f Credits Rafie Muhammad...

FIRST DEPOSITOR ATTACK IS PRESENT IN THE Vault.sol CONTRACT

Lines of code Vulnerability details Impact The Vault.deposit function is vulnerable to first depositor attack. It can be described as follows: A malicious early depositor can deposit with 1 wei of asset token as the first depositor of the Vault, and get 1 wei of shares. Then the first depositor c...

Atlas Business Directory Listing 2.13 Cross Site Scripting

Exploit Title: Atlas Business Directory Listing 2.13 - Reflected XSS Exploit Author: CraCkEr Date: 09/07/2023 Vendor: Creativeitem Vendor Homepage: https://creativeitem.com/ Software Link: https://demo.creativeitem.com/atlas/ Tested on: Windows 10 Pro Impact: Manipulate the content of the site...

Possible Issues Related to Well Initial State

Lines of code Vulnerability details Description && Impact After creating the Well contract, there will be no reserves in the initial state. Therefore it could lead to the following possible issues and the attackers can take advantage of them through front running. 1. Price manipulation attacks Wh...

Flash loan price manipulation in Well.sol

Lines of code Vulnerability details Impact Line 214 of Well.sol calculates the price of tokens to tokens in the pool based on the balances at a single point in time. Pool balances at a single point in time can be manipulated with flash loans, which can skew the numbers to the extreme. The single...

price-wizard.com Cross Site Scripting vulnerability OBB-3488210

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

DENIAL OF SERVICE COULD OCCUR IF CHAINLINK PRICE FEEDS ARE BLOCKED

Lines of code Vulnerability details Impact Protocol’s usability becomes very limited when access to Chainlink oracle data feed is blocked The LibOracle.readChainlinkFeed function calls the feed.latestRoundData on the chain link price feed to calculate the quotePrice and retrun it to the...

Use of slot0 to get sqrtPriceLimitX96 can lead to price manipulation.

Lines of code Vulnerability details Impact In the RootBrigdeAgent.sol the function's gasSwapOut and gasSwapIn uses UniswapV3.slot0 to get the value of sqrtPriceX96 which it use to perform the swap, however the sqrtPriceX96 gotten from Uniswap.slot0 is the most recent data point and can be...

Liquidity providers may lose funds when initialising a strategy

Lines of code Vulnerability details Summary Liquidity providers may lose funds when initialising a strategy Vulnerability Detail Liquidity providers may lose a portion of provided liquidity in either of the pair tokens when creating a new position. The init function on TalosBaseStrategy.sol does...

Malicious code in coingecko-price (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 06ba52961b5d886349fdb5a7c3e6362cedaaa64cb5857d5645d7360a68d133d1 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

WordPress Cryptocurrency Widgets – Price Ticker & Coins List Plugin <= 2.6.2 is vulnerable to Broken Access Control

Software Cryptocurrency Widgets – Price Ticker & Coins List Type Plugin Vulnerable versions = 2.6.2 Fixed in 2.6.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36681 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ec249fa35f9a...

Malicious code in binance-price (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 421081a4101ed61796fd72e7dec62cafa098a1d01934298a2ef82ef7187c4934 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Calls to rigidRedemption can fail due to an underflow when collateralAsset price falls.

Lines of code Vulnerability details Impact When the collateralAsset price falls drastically a wrong collateralAmount is calculated in the line below from the eusdAmount. The collateralAmount calculated can be greater than the amount deposited by the provider in the rigidRedemption. Which leads to...

A Dutch trade could end up with an unintended lower closing price

Lines of code Vulnerability details Impact notTradingPausedOrFrozen that is turned on and off during an open Dutch trade could have the auction closed with a lower price depending on the timimg, leading to lesser capability to boost the Rtoken and/or stRSR exchange rates as well as a weakened...

Canto pool could be drained.

Lines of code Vulnerability details Impact It was written that there a limit for 10 USDC /10 USDT /0.01 ETH, which currently equals to 10 USDT/ 10 USDC/ 18 USDT almost. These limits are for 4 Canto. Which means code accepts the Canto price at max: 2,5 USDC or equavalent. It is also written in the...

Malicious code in price-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6217a71efdaee9fdf44b7f4197557c52db54fdf782e0d4a5f1f81ad6eb925601 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Malicious code in price-record (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3b87630cf8eb8594e67451df7fae7627d35da7c1f67a44b1751201766dbe54a0 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-696 Malicious code in price-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6217a71efdaee9fdf44b7f4197557c52db54fdf782e0d4a5f1f81ad6eb925601 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...