3028 matches found
CVE-2021-24666
The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module not activated by default, which adds the rest route '/services/contributor/?P\d+, takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi...
CVE-2021-24666 Podlove Podcast Publisher < 3.5.6 - Unauthenticated SQL Injection
The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module not activated by default, which adds the rest route '/services/contributor/?P\d+, takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi...
WordPress 插件 SQL注入漏洞
WordPress Plugin is an open source application plugin for WordPress. A SQL injection vulnerability exists in the WordPress plugin Podlove Podcast Publisher, which stems from the fact that versions of the Podlove Podcast Publisher WordPress plugin prior to version 3.5.6 include a "Social and...
bondBurn() Leads to Unrecoverable Tokens
Handle leastwood Vulnerability details Impact An auction bonder has a single day's worth of blocks to call settleAuction and perform the necessary rebalance. In the event this does not happen, any user is able to call bondBurn and have the bond burnt in its entirety. As a result, the basketTokens...
Zero fees
Handle goatbug Vulnerability details Impact The fees system is broken. Anyone can easily pay zero fees. Proof of Concept Create a bundle of two txs to be mined in one block. First tx calls mintTo with an extrememly small amount, handleFees is called and importantly lastFee = block.timestamp; Seco...
Publisher May Accidentally Publish New Index With Incorrect Token Decimals
Handle leastwood Vulnerability details Impact The defiProtocol platform expects all tokens to be 18 decimals, however, nowhere in the contracts is this behaviour enforced. As a result, if a publisher mistakenly publishes a new index with new tokens that don't conform to this standard, settleAucti...
Reentrancy in settleAuction(): malicious publisher can bypass index timelock mechanism, inject malicious index, and rug the basket
Handle kenzo Vulnerability details The settleAuction function calls withdrawBounty before setting auctionOngoing = false, thereby allowing reentrancy. Impact A malicious publisher can bypass the index timelock mechanism and publish new index which the basket's users won't have time to respond to...
CVE-2020-12080
A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain message protocol can be exploited to cause lmadmin to crash...
CVE-2020-12080
A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain message protocol can be exploited to cause lmadmin to crash...
Denial of service
A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain message protocol can be exploited to cause lmadmin to crash...
CVE-2020-12080
CVE-2020-12080 affects FlexNet Publisher’s lmadmin.exe 11.16.6. A DoS arises from a crafted message protocol that can crash lmadmin, with network-based access and no authentication required (CVSSv3.1: 7.5 Critical; CVSSv2: 5.0). The available documents confirm the vulnerability and its impact but...
CVE-2020-12080
A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain message protocol can be exploited to cause lmadmin to crash...
Flexera Software FlexNet Publisher 输入验证错误漏洞
Flexera Software FlexNet Publisher FLEXlm is the core software license management component of the Entitlement Relationship Management Solution from Flexera Software. The product provides software and hardware manufacturers with the ability to price, package, and customize software license terms...
hilarispublisher.com Cross Site Scripting vulnerability OBB-2128804
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Oracle Fusion Middleware BI Publisher Arbitrary File Upload (CVE-2021-2392)
An arbitrary file upload vulnerability exists in Oracle Business Intelligence. This vulnerability is due to insufficient input validation in the UploadFndDBCPage class...
CVE-2021-40089
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disable...
CVE-2021-40089
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disable...
Design/Logic Flaw
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disable...
Primekey Solutions PrimeKey EJBCA 安全漏洞
Primekey Solutions PrimeKey EJBCA is a full-featured CA system software from PrimeKey Solutions Primekey Solutions, Sweden. The software is used for domain certificate management, enrollment and enrollment-to-certificate validation and other functions to achieve access security. A security...
PT-2021-22799 · Primekey · Ejbca
Name of the Vulnerable Software and Affected Versions: PrimeKey EJBCA versions prior to 7.6.0 Description: An issue was found where the General Purpose Custom Publisher could still run even when the System Configuration setting Enable External Script Access was disabled. Although this setting...