11806 matches found
PT-2023-4675 · Unknown · Mxsecurity
Name of the Vulnerable Software and Affected Versions: MXsecurity versions prior to v1.0.1 Description: A vulnerability has been identified that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI. This issue might allow an unauthenticated remote attacker to...
The vulnerability of SAP ERP Defense Forces and Public Security software lies in the improper processing of output data for registration logs, allowing a perpetrator to re-record arbitrary files.
The vulnerability of SAP ERP Defense Forces and Public Security software is related to incorrect processing of output data for registration logs. Exploiting this vulnerability can allow a malicious actor to re-record arbitrary files...
HTML Injection - real Aptabase emails
Description Due to lack of validation Name field during registration, bad actor can send emails with HTML injected code to the victims. Proof of Concept Payload example: Jameees Repro steps: Go to https://eu.aptabase.com/auth/register and for field 'Name' use payload with HTML. Open email from...
CVE-2023-38698
Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration...
Integer overflow
Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration...
CVE-2023-38698 .eth registrar controller can shorten the duration of registered names
Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration...
CVE-2023-38698 .eth registrar controller can shorten the duration of registered names
Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration...
The vulnerability of Splunk SOAR’s software for orchestration, automation, and incident response lies in its improper handling of output data from registration logs, allowing attackers to execute arbitrary code.
The vulnerability of Splunk SOAR’s software for orchestration, automation, and security incident response is related to improper processing of output data from registration logs. Exploiting this vulnerability can allow a perpetrator to execute arbitrary code...
CVE-2022-4888
The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custom Order Number WordPress plugin through 1.0.1, Custom Registration Forms Builder WordPress plugin before 1.0.2,...
PT-2023-15899 · WordPress · Checkout Fields Manager +12
Name of the Vulnerable Software and Affected Versions: Checkout Fields Manager WordPress plugin versions prior to 1.0.2 Abandoned Cart Recovery WordPress plugin versions prior to 1.2.5 Custom Fields for WooCommerce WordPress plugin versions prior to 1.0.4 Custom Order Number WordPress plugin...
faulty users can abuse the function delegate in NFTBoostVault.sol
Lines of code Vulnerability details Impact The contract NFTBoostVault.sol lets users to register their tokens/optional NFT's in exchange of voting power. in this contract its mandatory for users to be registered in order to lock their tokens and claim voting power, as its mentioned in the code...
Users' registration amounts and contract balance state will be incremented incorrectly if the NFTBoostVault::_lockTokens() silently fails
Lines of code Vulnerability details Users can add and lock tokens to the NFTBoostVault contract to increase their voting power using addTokens function. This function will increment the contract's balance state and the user's registration.amount. Then, it will sync the voting power according to t...
User can drain all locked tokens during withdrawal and still retain their voting power
Lines of code Vulnerability details Impact In the NFTBaseVault.sol contract, a user can decide to withdraw all locked tokens by calling the withdraw... function until all locked funds are drained and the still retain their voting power. Proof of Concept if a user malicious or not decides not to...
[MEDIUM] NFTBoostVault#addNftAndDelegate - Not setting a delegatee in the addNftAndDelegate will cause the addTokens function and updateNft to revert
Lines of code Vulnerability details Impact The absence of a delegatee in the addNftAndDelegate function in the NFTBoostVault contract will cause the addTokens and updateNft functions to revert. This is due to the assumption that a delegatee has been set, which is not always true. This issue may...
This Week in Spring - July 25th, 2023
Hi, Spring fans! Welcome to another installment of This Week in Spring! Look, I'm going to level with you. This is the view from where I'm staying on holiday right now in tropical Lankawi, Malaysia: I'm super interested in this week's roundup, as always, but I'm also very interested in that...
PT-2023-8418 · Apple · Ipados +3
Name of the Vulnerable Software and Affected Versions: iOS versions prior to 16.6 iPadOS versions prior to 16.6 macOS Ventura versions prior to 13.5 Description: A privacy issue was addressed with improved private data redaction for log entries. This issue may allow an app to read sensitive...
CWE-521: Weak Password Requirements
Description Users at this moment can set really weak password like 123. Proof of Concept Go to register page and set really weak password like 123, see allowed - registered in. For example, go to https://sandbox.openedx.org/register?next=/dashboard , type '1' see info 'This password is too short...
CVE-2023-37362
Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website...