The onlyMinter modifier checks the wrong condition.

Lines of code Vulnerability details Impact In RabbitHoleReceipt.sol and RabbitHoleTicket.sol, receipts and tickets can be minted by anyone. Proof of Concept The first line inside the modifier can be passed without reverting for any callers. modifier onlyMinter msg.sender == minterAddress; ; Tools...

Vulnerability of the `getReadReceipts` method in the server-based corporate messaging system that supports file and video conferences. Chat, which allows attackers to expose sensitive information.

The vulnerability of the getReadReceipts method in the server-based corporate messaging system that supports file and video conferences. Chat involves insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

Use of arbitrary ERC20 tokens could result misaccounting of funds

Lines of code Vulnerability details Vulnerability details If the token is set to a deflationary/fee-on-transfer token then its actual transfer amounts will not be accurately reflected in the protocol accounting given the lack of pre-transfer and post-transfer checks on asset transfers. Impact Som...

CVE-2022-30628

It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL...

Authentication flaw

It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL...

Why Paper Receipts are Money at the Drive-Thru

Check out this handmade sign posted to the front door of a shuttered Jimmy Johns sandwich chain shop in Missouri last week. See if you can tell from the store owners message what happened. If you guessed that someone in the Jimmy Johns store might have fallen victim to a Business Email Compromise...

Authentication Bypass

bytefury/crater is vulnerable to authentication bypass. The vulnerability exists due to improper user validation handling in payment method delete which allows an unauthenticated user to all expense receipts uploaded to a company...

Improper Access Control in crater-invoice/crater

Description In recent Crater version faf1ef09 tag: 5.0.6 I discovered, that not authenticated user can download all expense receipts uploaded to any company. Proof of Concept Python import requests for i in range1, 100: r = requests.getf'http://172.17.0.1:8080/expenses/i/download-receipt' if...

@graphprotocol/payments (>=0.0.2-next.a995f4b.40, <=0.1.0), @graphprotocol/receipts (>=0.0.2-next.a995f4b.40, <=0.1.0) +2 more potentially affected by CVE-2021-3766 via objection (>=2.1.2, <=2.2.14)

objection NPM version =2.1.2, =0.0.2-next.a995f4b.40, =0.0.2-next.a995f4b.40, =0.0.2, =0.2.0, =1.25.2 Source cves: CVE-2021-3766 Source advisory: OSV:GHSA-R659-8XFP-J327...

The vulnerability of the Receipts sub-component of the Oracle Receivables component in the Oracle E-Business Suite system, which allows a perpetrator to gain unauthorized access to the device.

The vulnerability of the Receipts sub-component of the Oracle Receivables component in the Oracle E-Business Suite system is related to code errors. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the device through HTTP requests...

CVE-2021-2223

Vulnerability in the Oracle Receivables product of Oracle E-Business Suite component: Receipts. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Receivables. Successful attacks...

CVE-2021-2223: Undefined Security Weakness

Vulnerability in the Oracle Receivables product of Oracle E-Business Suite component: Receipts. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Receivables. Successful attacks...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2021-37753)

Oracle E-Business Suite is an extension of the original Application ERP, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management, and so on, a collection of management software, is seamlessly integrated into a management suite.Oracle...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite is an extension of the original Application ERP, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management, and so on, a collection of management software, is seamlessly integrated into a management suite.Oracle...

Fedora 30 : matrix-synapse (2019-80f1943143)

This release includes four security fixes : - Prevent an attack where a federated server could send redactions for arbitrary events in v1 and v2 rooms. - Prevent a denial-of-service attack where cycles of redaction events would make Synapse spin infinitely. - Prevent an attack where users could b...

FreeBSD : py-matrix-synapse -- multiple vulnerabilities (38d2df4d-b143-11e9-87e7-901b0e934d69)

Matrix developers report : The matrix team releases Synapse 1.2.1 as a critical security update. It contains patches relating to redactions and event federation : - Prevent an attack where a federated server could send redactions for arbitrary events in v1 and v2 rooms. - Prevent a...

py-matrix-synapse -- multiple vulnerabilities

Matrix developers report: The matrix team releases Synapse 1.2.1 as a critical security update. It contains patches relating to redactions and event federation: Prevent an attack where a federated server could send redactions for arbitrary events in v1 and v2 rooms. Prevent a denial-of-service...

CVE-2018-19434

The CVE-2018-19434 issue affects webERP 4.15 within the General Ledger component, specifically the Bank Account Matching - Receipts screen. BankMatching.php contains a Blind SQL injection vulnerability via the AmtClear_ parameter that can be exploited remotely to execute SQL commands. This vulner...

webERP General Ledger Component SQL Injection Vulnerability

webERP is an open source inventory and financial management system ERP system. The system supports inventory management , rights role management , order management and financial management , etc. General Ledger is one of the ledger components . A SQL injection vulnerability exists in the 'Bank...

PT-2018-14960

Name of the Vulnerable Software and Affected Versions webERP version 4.15 Description An issue was discovered on the Bank Account Matching - Receipts screen of the General Ledger component. This issue involves Blind SQL injection via the AmtClear parameter in BankMatching.php. Recommendations For...