WordPress Review Stream Plugin <= 1.6.5 is vulnerable to Cross Site Scripting (XSS)

Software Review Stream Type Plugin Vulnerable versions = 1.6.5 Fixed in 1.6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28774 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d19b354aa4eb Credits Rio Darmawan Required...

Review Stream <= 1.6.5 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

genealogic.review Cross Site Scripting vulnerability OBB-3236223

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-20027

creationtimestamp| type| source ---|---|--- 2023-03-23 19:36:57+00:00| seen| https://t.me/cibsecurity/60596 2023-03-24 11:20:58+00:00| seen| https://t.me/truesecator/4210 2023-07-03 11:56:00+00:00| seen| https://www.jerrygamblin.com/2023/07/03/2023-first-half-cve-data-review/...

Important: nss security and bug fix update

Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fixes: nss: Arbitrary memory write via PKCS 12 CVE-2023-0767 Bug Fixes: In FIPS mode, nss should reject RSASSA-PSS salt lengths large...

totalFunds update is missing in Liquidity.openShort

Lines of code Vulnerability details Impact totalFunds is not updated in Liquidity.openShort so totalFunds will be wrong. Proof of Concept Liquidity.openShort updates usedFunds only and doesn't update totalFunds. totalFunds should be updated after openShort. Tools Used Manual Review Recommended...

LiquidityPool.executePerpOrders(): dangerous payable function

Lines of code Vulnerability details Impact The contract LiquidityPool use a dangerous payable function executePerpOrders In this function, users can send ETH mistakenly. We should check the msg.value is 0 or not to void this issue. Proof of Concept function executePerpOrdersbytes calldata...

Unlimited minting of Canto Bio NFT

Lines of code Vulnerability details Impact There is no max limit on the number of Bio NFT that can be minted by a user. This allows an attacker to mint himself any amount of Bio NFT he want. Proof of Concept function testMint public string memory bio = "TEST BIO"; vm.prankalice; for uint i = 0; i...

Unsafe cast

Lines of code Vulnerability details Impact In AccountCodeStorage.sol we have function getCodeHash and getCodeSize Due to an insecure cast, it is possible to get an integer overflow. Solidity version 0.8.0 provide SafeMath, but casting operations are not safe and can overflow. Proof of Concept As...

[H-01] User that fuse more tiles to Namespace NFT pay lesser fusing costs instead of greater

Lines of code Vulnerability details Impact User that fuses more tiles will pay lesser fusing costs to revenueAddress instead of higher cost as intended Proof of Concept Namespace.solL110-L114 /Namespace.sol 110: function fuseCharacterData calldata characterList external 111: uint256 numCharacters...

DefaultAccount will add system call flag to any call with msg.value

Lines of code Vulnerability details Impact As mentioned in the repo's README.md documentation: isSystem flag. Whether the call intends a system contracts' function. While most of the system contracts' functions are relatively harmless, accessing some with calldata only may break the invariants of...

L2EthToken.withdraw can be underflow with little cost

Lines of code Vulnerability details Impact calculating balanceaddressthis within unchecked will cause underflow. Say if balanceaddressthis == 1 and msg.value == 2, after calling withdraw, balanceaddressthis will be typeuint256.max Proof of Concept function underFlowuint a, uint b public pure...

Lack of a contract existence check may lead to undesired behavior

Lines of code Vulnerability details Impact The functions NeoTokyoStaker.assetTransferFrom and NeoTokyoStaker.assetTransfer are both used as helper functions to perform low level calls, both functions revert if the low-level call fails, but no checks are made if the contract that's being called...

wrong updating lp position

Lines of code Vulnerability details Impact lock lp token at staking more than required when user adds some lp token staking amount, contract uses new timelockEndTime for previously staked amount . Proof of Concept Scenario : user have some amount of lp token staked for a period of time like 30 da...

User Rewards will be lost in case of Withdraw

Lines of code Vulnerability details Impact User loses his unclaimed rewards If user withdraw all of his staked tokens he won't be able to claim rewards Proof of Concept the point is used to calculate user rewards and when a user withdraw all of its staked tokens the point will be set to zero and...

A week in security (March 6 - 12)

Last week on Malwarebytes Labs: 8 cybersecurity tips to keep you safe when travelling National Cybersecurity Strategy Document: What you need to know Intel CPU vulnerabilities fixed. But should you update? Warning issued over Royal ransomware Play ransomware gang leaks City of Oakland data...

S4x23 Review Part 2: Evolving Energy Cybersecurity

In this second report on S4x23 held last February, this article introduces the discussion on cyber security in the energy industry, which was one of the topics that attracted attention...

Funds in DAO contract cannot be withdrawn

Lines of code Vulnerability details Impact The DAO contract can receive funds but can not withdraw, Funds occasionally sent by users will be stuck in those contracts. Proof of Concept Receive funds through deposit function in DAO.solL218-L236 /// @inheritdoc IDAO function deposit address token,...

No enough validation check for isValidSignature

Lines of code Vulnerability details Impact There is not enough validation check for the isValidSignature function. The only validation check for the signature is that for Zero address which returns false. There should be enough validation check Proof of Concept Tools Used Manual Review Recommende...

TicketUtils#reconstructTicket is biased towards lower numbers and allows gaming of odds

Lines of code Vulnerability details Impact Probability of lower numbers is higher and odds can be gamed Proof of Concept for uint256 i = 0; i selectionSize; ++i numbersi = uint8randomNumber % currentSelectionCount; randomNumber /= currentSelectionCount; currentSelectionCount--; To determine the...