crosis information leakage vulnerability

crosis is a JavaScript client that uses the Replit container protocol. crosis is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to obtain a token used to connect to Repl...

Catalyst It Ltd Mahara Cms 代码问题漏洞

Catalyst It Ltd Mahara Cms is a fully featured electronic portfolio, blog, resume builder and social networking system from Catalyst It Ltd in New Zealand. Used to connect users and create online communities. A security vulnerability exists in Catalyst It Ltd Mahara Cms, which stems from the...

CVE-2021-41580

The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants...

OPENSUSE-SU-2021:1225-1 Security update for dovecot23

This update for dovecot23 fixes the following issues: Update dovecot to version 2.3.15 jscSLE-19970: Security issues fixed: - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens, if attacker has...

Cross site request forgery (csrf)

In SapphireIMS 5.0, there is no CSRF token present in the entire application. This can lead to CSRF vulnerabilities in critical application forms like account resent...

Authentication flaw

A weak session token authentication bypass vulnerability in Trend Micro IM Security 1.6 and 1.6.5 could allow an remote attacker to guess currently logged-in administrators' session session token in order to gain access to the product's web management interface...

CVE-2021-31520

A weak session token authentication bypass vulnerability in Trend Micro IM Security 1.6 and 1.6.5 could allow an remote attacker to guess currently logged-in administrators' session session token in order to gain access to the product's web management interface...

MGASA-2021-0126 Updated ceph packages fix security vulnerabilities

A flaw was found in Ceph where Ceph stores mgr module passwords in clear text. This issue can be found by searching the mgr logs for Grafana and dashboard with passwords visible. The highest threat from this vulnerability is to confidentiality CVE-2020-25678. A flaw was found in ceph-dashboard. T...

CVE-2020-25105

eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token createHash has only a million possibilities...

MoneyChainNet Digital Error Vulnerability

MoneyChainNet MCN is an ethereum-based digital currency. An input validation error vulnerability exists in the 'mintToken' function in MCN's smart contract implementation. An attacker can exploit the vulnerability to set the balance of any user to an arbitrary value...

Logic Flaw Vulnerability in GOAL Bonanza

GOAL Bonanza GOAL is an ethereum-based virtual currency.A security vulnerability exists in the 'mintToken' function in GOAL's smart contract implementation. An attacker could exploit the vulnerability to increase the balance of a digital asset at any address...

Logic Flaw Vulnerability in SpeedCashLite

SpeedCashLite SCSL is an Ether-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in the smart contract implementation of SCSL. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...

SwapToken has a flawed logic vulnerability

SwapToken is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function in SwapToken's smart contract implementation. An attacker could use this vulnerability to prevent the seller from obtaining the assets due to the exchange...

Logic Flaw Vulnerability in CIBN Live Token

CIBN Live Token CIBN LIVE is an Ether-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in the smart contract implementation of CIBN LIVE. An attacker could use this vulnerability to set the balance of any user to an arbitrary value...

JPaseto weak hash vulnerability

JPaseto is a Java library for creating and parsing Paseto . A weak hash vulnerability exists in JPaseto versions prior to 0.3.0. The vulnerability stems from the fact that JPaseto generates weak hashes when using v2.local tokens. No details of the vulnerability are provided at this time...

Node.js third-party modules: [authmagic-timerange-stateless-core] Improper Authentication

I would like to report Improper Authentication in authmagic-timerange-stateless-core It allows to forge user's identity. Module module name: authmagic-timerange-stateless-core version: 0.0.9 npm page: https://www.npmjs.com/package/authmagic-timerange-stateless-core Module Description Stateless an...

CVE-2018-17882

An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle CBTB, an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user...

CVE-2019-8336

HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 is vulnerable to an access-restriction bypass, enabling a client to obtain the privileges of another arbitrary token in secondary datacenters due to a token with "" as its secret. Impact: privilege escalation. Remediation: upgrade to 1.4...

CoquinhoERC20 Integer Overflow Vulnerability

CoquinhoERC20 is a tradable Ether ERC20 token. An integer overflow vulnerability exists in the mintToken function of CoquinhoERC20's smart contract implementation. The vulnerability can be exploited by the contract owner to set the balance of any user to any value...

EXGROUP Numeric Error Vulnerability

EXGROUP is an Ether-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in EXGROUP's smart contract implementation. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...