removeLiquiditySingle loses funds

Handle cmichel Vulnerability details Vulnerability Details The Pool.removeLiquiditySingle function redeems liquidity tokens for underlying to the router contract. If toBase == true, it then tries to convert these to base tokens. However, only the swapped token - BASE amount is sent to the user, t...

Pool: approveAndCall sets unnecessary approval

Handle cmichel Vulnerability details Vulnerability Details The Pool.approveAndCall function approves the recipient contract with the max value instead of only the required amount. Impact For safety, the approval should not be set to the max value, especially if the amount that the contract may us...

Business Logic Errors in seriawei/zkeacms

✍️ Description ZKEACMS is vulnerable to Business Logic error through negative product amount. 🕵️‍♂️ Proof of Concept PoC file content: HTML setTimeout = form.submit , 2000; 1. Save the above content into an HTML file. 2. Open it on the browser. Check the shopping cart negative value. PoC video. 💥...

buyFYToken and buyBase do not reimburse leftovers

Handle pauliax Vulnerability details Impact functions buyFYToken and buyBase do not reimburse leftovers. It checks that the transferred amount is between min and max boundaries, however, it does not send back any excess amount back to the sender nor it accounts it in the update function e.g. it...

Longer maturity leads to lower returns

Handle cmichel Vulnerability details Vulnerability Details The LinearDecayInterestModel computes the interestAmount on a deposit as depositAmount moneyMarketInterestRatePerSecond IRMultiplier depositPeriodInSeconds where the IRMultiplier is a function of the depositPeriodInSeconds computed in:...

Ransomware Gang Leaks Metropolitan Police Data After Failed Negotiations

The cybercrime syndicate behind Babuk ransomware has leaked more personal files belonging to the Metropolitan Police Department MPD after negotiations with the DC Police broke down, warning that they intend to publish all data if their ransom demands are not met. "The negotiations reached a dead...

CVE-2020-29540

API calls in the Translation API feature in Systran Pure Neural Server before 9.7.0 allow a threat actor to use the Systran Pure Neural Server as a Denial-of-Service proxy by sending a large amount of translation requests to a destination host on any given TCP port regardless of whether a web...

Indian National Gets 20-Year Jail in United States for Running Scam Call Centers

An Indian national on Monday was sentenced to 20 years in prison in the Southern District of Texas for operating and funding India-based call centers that defrauded US victims out of millions of dollars between 2013 and 2016. Hitesh Madhubhai Patel aka Hitesh Hinglaj, who hails from the city of...

Logic Flaw Vulnerability in WordPress Simple PayPal Shopping Cart

WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers that support PHP and MySQL databases. A logic flaw exists in WordPress Simple PayPal Shopping Cart. An attacker can exploit the vulnerability to modify the payment amount...

Wordlist_Generator - Unique Wordlist Generator Of Unique Wordlists

wordlistgenerator generates wordlists with unique words with techniques mentioned in tomnomnom's report "Who, What, Where, When". It takes URLs from gau and splits them to get words in URLs. Then it requests each URL to fetch all words. Finally, wordlistgenerator removes from wordlist everything...

Cangzhou Jialan Network Technology Co., Ltd. virtual goods automatic delivery system there are logical flaws vulnerabilities

JiaBlue virtual goods automatic delivery system is the latest one-stop self-service delivery platform launched by JiaBlue Technology, which supports automatic delivery of virtual goods, paid article reading, paid audio and video, paid gallery and so on. The whole process does not require human...

Shijiazhuang City Zhenghong Network Technology Co., Ltd. Shop7z online shopping system fashion version of the existence of logic flaws vulnerability

Shop7z online shopping system is ASP online store platform software, providing comprehensive application services based on Internet solutions. Shijiazhuang City Zhenghong Network Technology Co., Ltd. Shop7z online shopping system fashion version of the existence of logical flaws in the...

Logic Flaw Vulnerability in Rice CMS

DAMI CMS is a PC building station and cell phone building station integrated all-in-one system. A logic flaw vulnerability exists in Daimi CMS, which can be exploited by an attacker to modify the order amount...

DigitalOcean Data Leak Incident Exposed Some of Its Customers Data

DigitalOcean, one of the biggest modern web hosting platforms, recently hit with a concerning data leak incident that exposed some of its customers' data to unknown and unauthorized third parties. Though the hosting company has not yet publicly released a statement, it did has started warning...

BTC Public Chain Portfolio Output Overflow

The BTC public chain is an Ethernet-based public chain. There is a data output overflow vulnerability in the public chain portfolio. An attacker can exploit the vulnerability to not pay or underpay an amount...

Logic Flaw Vulnerability in Shop7 Online Shopping System Flagship Edition

Shop7 online shopping system flagship version is to support Alipay, WeChat payment and a variety of commonly used interfaces, computer version and cell phone version and APP seamless combination of data as a whole. Shop7 online shopping system flagship version of the existence of logical flaws in...

Logic flaw vulnerability in Liangjing Mall online store shopping system (CNVD-2020-25591)

Liangjing Mall Online Shop Shopping System is a multifunctional online store system. There is a logic flaw vulnerability in Liang Jing Mall Online Shop Shopping System, which can be exploited by attackers to modify the transaction amount...

Researchers Warn of Novel PXJ Ransomware Strain

Researchers have discovered a new strain of ransomware, dubbed “PXJ,” which emerged in the wild in early 2020. While PXJ performs functions similar to other ransomware variants, it does not appear to share the same underlying code with most known ransomware families, researchers said. They first...

Logic flaw vulnerability in the payment system of Jiangsu Jinzhi Education Information Technology Co.

Jiangsu Jinzhi Education Information Technology Co., Ltd. is the largest education informatization service provider in China. A logic flaw vulnerability exists in the payment system of Jiangsu Jinzhi Education Information Technology Co. Ltd. that can be exploited by an attacker to modify the...

Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2019-1783)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...