[WP-H14] ConvexStakingWrapper, StakingRewards Wrong implementation will send concur rewards to the wrong receiver

Lines of code Vulnerability details UserInfo storage user = userInfopidmsgSender; updatePoolpid; ifuser.amount 0 uint pending = user.amount pool.accConcurPerShare / concurShareMultiplier - user.rewardDebt; if pending 0 safeConcurTransferrecipient, pending; ConvexStakingWrapper, StakingRewards is...

PT-2021-22471 · Nextcloud · Nextcloud Mail

Name of the Vulnerable Software and Affected Versions: Nextcloud Mail versions prior to 1.10.4 and 1.11.0 Description: The Nextcloud Mail application has a privacy filter issue that fails to filter images with a relative protocol, potentially leaking the read state or user IP. This issue is due t...

The assumption that operator == to (user) may not hold leading to failed timelock deposits

Handle 0xRajeev Vulnerability details Impact The contract uses msgSender to denote an operator who is operating on behalf of the user. This is typically used for meta-transactions where the operator is an intermediary/relayer who may facilitate gasless transactions on behalf of the user. They may...

Deposit whitelist enforced on msg.sender instead of user

Handle 0xRajeev Vulnerability details Impact The Treasury deposit function credits amount to the user address in parameter instead of the msgSender that is actually making the deposit whose rationale as explained in the Natspec comment is that this may be called via contract or L1-L2 bot. However...

CVE-2020-4912

IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-Force ID: 191287...

D-link DSL-2888A 访问控制错误漏洞

The D-link DSL-2888A is a Unified Services Router from D-link China. An authorization issue vulnerability exists in the D-Link DSL-2888A devices with firmware, which can be exploited by an attacker to assign a static IP address that has been previously used by a valid user...

Logic flaw vulnerability in JLCMS of Beijing Liangjing Zhicheng Technology Co.

LJCMS is a PHP+MYSQL based enterprise website system. There is a logic flaw vulnerability in JLCMS of Beijing Liang Jing Zhi Cheng Technology Co., Ltd. that can be exploited by attackers to obtain other people's user address information...

Logic Flaw Vulnerability in Liangjing Mall Online Shop Shopping System (CNVD-2020-27282)

Liangjing Mall online shopping system is a set of multi-functional online store system that can fit different types of goods and is super flexible. A logic flaw exists in LiangJing Mall Online Shop System, which can be exploited by an attacker to delete the address information of an entire site...

Information Disclosure in WildFire Appliance (WF-500)

Palo Alto Networks has determined that the WildFire Appliance WF-500 is affected by the vulnerability disclosure known as LazyFP and has completed an update to address these issues. The WildFire Appliance WF-500 software update is now available to customers that use the WildFire Appliance WF-500...

Starbucks: Bug in GraphQL and API integration leads to limited user address disclosure

A modified GraphQL query to fetch a user's address book entries led to a limited disclosure of user address book entries. The modified query resulted in a backend API request with undefined as a parameter. The response contained address lists of accounts with a username of undefined. We were not...

Kaspersky: Kaspersky Password Manager allows websites to access user's address data

Note: According to https://www.securityweek.com/kaspersky-adds-password-manager-bug-bounty-program and some other sources, Kaspersky Password Manager is in scope for this program. The program description doesn't reflect this however. Summary It is possible for websites to read out addresses that...

Magento Community Edition and Enterprise Edition Cross-Site Request Forgery Vulnerability

Magento is an open source PHP e-commerce system from Magento Inc. that provides rights management, search engine, and payment gateway.Magento Community Edition CE is a community edition.Magento Enterprise Edition EE is an enterprise edition. A cross-site request forgery vulnerability exists in...

CVE-2017-9724

In all Qualcomm products with Android releases from CAF using the Linux kernel, user-level permissions can be used to gain access to kernel memory, specifically the ION cache maintenance code is writing to a user supplied address...

Google Android Qualcomm Linux kernel privilege acquisition vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA, and the Qualcomm Linux kernel is one of the Qualcomm Linux kernels. A security vulnerability exists in the Qualcomm Linux kernel in Android. An attacker can exploit the...

Huacheng Gas Group Android APP has design flaws

Huacheng Gas Group Android APP is a client application that provides users with integrated management of remote meter reading and online bill payment. There is a design vulnerability in the verification code of Huacheng Gas Group Android APP. An attacker can use the vulnerability to reset any...

OIC Exponent CMS Information Disclosure Vulnerability (CNVD-2016-11167)

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. An information disclosure...

方维名品折扣系统越权清除用户收货地址 (Demo)

简要描述： RT 详细说明： demo地址：http://mp.fanwe.net 老规矩注册两账号 账号A收货地址 账号B 收货地址 点击账号B的提交，抓包修改地址id为账号A的地址id 查看账号A地址，发现被清除 漏洞证明： 如上...

I-net Multi User Email Script SQLi Vulnerability

No description provided by source. Name : I-net Multi User Email Script SQLi Vulnerability Date : june, 27 2010 Critical Level : HIGH Vendor Url : http://www.i-netsolution.com/ Google Dork: inurl:/jobsearchengine/ Author : Sid3^effects aKa HaRi shellc99atyahoo.com special thanks to : r0073r...

Tencent a certain activity a leak a large number of user address information-bug warning-the black bar safety net

Friends through QQ sent me to one of the activities:“there is no free lunch, but for Breakfast you can have! I was participating in yinlu good porridge road free good Breakfast apply for activities, the same address apply for the number up to 2 0 people, Homo habilis hand is a free good Breakfast...

Hitechvalley iNet CMS advanced SQL Injection vulnerability

Hitechvalley iNet is a CMS for nepalian webistes, which is used mainly by organizations, the govnerment and the Nepal Army. Exploit Title: Hitechvalley iNet CMS SQL Injection vulnerability Date: 24/02/2013 Author: Zyklon B - https://twitter.com/BZyklon Vendor or Software Link:...