309 matches found
Missing _token.approve() to curvePool in setZapConfig
Handle WatchPug Vulnerability details function setZapConfig uint256 idx, address sett, address token, address curvePool, address withdrawToken, int128 withdrawTokenIndex external onlyGovernance; requiresett != address0; requiretoken != address0; require withdrawToken == addressWBTC || withdrawTok...
uToken's approve() Function is Susceptible to Frontrunning Attacks
Handle leastwood Vulnerability details Impact Order makers will call the approve function to facilitate transactions between order takers and makers. If a taker sees that a maker is seeking to reduce its order exposure by reducing Swivel.sol's allowance, a taker can frontrun this transaction to...
logic calls can steal tokens
Handle 0xito Vulnerability details Impact attacker can send a logic call that performs a token.approveattackerAddress, typeuint256.max using the submitLogicCall function. afterwards, they can steal all tokens from the bridge using token.safetransferfrombridge, attacker, amount. Proof of Concept...
Block 18 Logic Flaw Vulnerability
Block 18 18T is an ethereum-based virtual currency.18T has a security vulnerability in the 'approveAndCallcode' function in its smart contract implementation, which stems from the program's failure to validate the callcode.An attacker could use this vulnerability to steal assets transfer the...
CVE-2020-8615
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions such as blocking legitimate instructors...
Tutor LMS < 1.5.3 - Cross-Site Request Forgery (CSRF)
Tutor LMS WordPress plugin is vulnerable to Cross-Site Request Forgery CSRF attacks. PoC As the requests for the approval and blocking of instructors are sent using the GET method, the CSRF attack to approve an attacker-controlled instructor account can be performed by having the admin visit...
CloudBees Jenkins Bitbucket Approve Plugin Trust Management Issue Vulnerability
CloudBees Jenkins Hudson Labs is a set of Java-based continuous integration tools from CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Bitbucket Approve Plugin is used in one of the plugin used to support uploading...
CVE-2019-1003057
Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
Design/Logic Flaw
Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
CVE-2019-1003057
Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
CVE-2019-1003057
Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
CVE-2019-1003057
Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
CVE-2019-1003057
CVE-2019-1003057 concerns the Jenkins Bitbucket Approve Plugin. The vulnerability arises from credentials stored unencrypted in the plugin’s global configuration file on the Jenkins master/controller, specifically in org.jenkinsci.plugins.bitbucket_approve.BitbucketApprover.xml, making them viewa...
PT-2019-11347 · Jenkins · Jenkins Bitbucket Approve Plugin
Name of the Vulnerable Software and Affected Versions: Jenkins Bitbucket Approve Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master or controller. Specifically, the...
SmartMesh Replay Attack Vulnerability
SmartMesh SMT is a blockchain-based underlying protocol for the Internet of Things IoT, positioned in the areas of meshless communication, meshless payment, and more. The 'transferProxy' and 'approveProxy' functions in SMT's smart contract are vulnerable to replay attacks, which can be exploited ...
Globalvillage ecosystem evilReflex has an unspecified vulnerability.
Globalvillage ecosystem GVE is a virtual currency system based on blockchain technology. A security vulnerability exists in the 'approveAndCallcode' function in GVE's smart contract implementation, which stems from the program's failure to validate the callcode.An attacker could use this...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that 1 ban a user via the username parameter in a dobanuser action to modcp/banning.php or 2 unban a user, 3 modify...
CVE-2014-9438
Cross-site request forgery CSRF vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that 1 ban a user via the username parameter in a dobanuser action to modcp/banning.php or 2 unban a user, 3 modify...
Ez Blog 1.0 - XSS/CSRF Multiple Vulnerabilities
No description provided by source. ----------------------------------------------------------------------------------------------- Title: Ez Blog XSS/XSRF Multiple Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 15. December 2009...