MaltRepository._revokeRole may not work correctly

Lines of code Vulnerability details Impact MaltRepository inherits from AccessControl and adds validation of validRoles to the hasRole function, which means that even if super.hasRolerole, account == true, if validRolesrole == false hasRole will return false, which will cause revokeRole to not wo...

inovesola.com Improper Access Control vulnerability OBB-3127878

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Owner may lose funds if Minipool is recreated before funds are withdrawn

Lines of code Vulnerability details The createMinipool function of the MinipoolManager contract can be used to reinitialize an existing minipool and potentially lose user funds. If the given nodeID has an existing minipool index, then the state for the minipool is reset: if minipoolIndex != -1...

CVE-2022-35120

IXPdata EasyInstall 6.6.14725 contains an access control issue...

CVE-2022-39038 FLOWRING Agentflow BPM - Broken Access Control

Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service...

revenueContract that uses AccessControl instead of Ownable can’t work with SpigotLib's removeSpigot()

Lines of code Vulnerability details Proof of Concept The code in removeSpigot is the following bool success, = revenueContract.call abi.encodeWithSelector self.settingsrevenueContract.transferOwnerFunction, self.operator // assume function only takes one param that is new owner address ; So...

[PNM-003] finalize can be called by bidders, allows them to cancelBid

Lines of code Vulnerability details Description The finalize function is used to finalize the auction, locking all bids, and paying the seller. However, any user, including bidders can call finalize, as it is a public function, and there are no user checks. This may allow bidders to input malicio...

CVE-2022-21557

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Container. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracl...

Missing Authorization in Jenkins WMI Windows Agents plugin

WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library. It provides a general-purpose remote command execution capability that Jenkins uses to check if Java is available, and if not, to install it. This library has a buffer overflow vulnerability that may allow user...

logivert.ba Improper Access Control vulnerability OBB-2438035

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

tilda.com Improper Access Control vulnerability OBB-2359421

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-38696

SoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control vulnerability, that allows attackers to access signature files on the application without any authentication...

diamondinvestmentestates.com Improper Access Control vulnerability OBB-2298605

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

vixcare.com Improper Access Control vulnerability OBB-2268167

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

yourlocaloffer.com Improper Access Control vulnerability OBB-2268099

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

livonialibrary.org Improper Access Control vulnerability OBB-2252407

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

weddingmatters.com.au Improper Access Control vulnerability OBB-2234736

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

weguang-plaza.com Improper Access Control vulnerability OBB-2215011

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

mediummundi.pl Improper Access Control vulnerability OBB-2181585

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

invisiblearabs.com Improper Access Control vulnerability OBB-2173981

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...