110 matches found
Owner of the BasketFacet can cause DoS for exitPool(...) function
Handle Czar102 Vulnerability details Impact Provided an owner can add any tokens to the basket, it may add a token, for which the owner can burn tokens from any account. Then, after adding the token to the basket, the owner may burn tokens so that token.balanceofBasketFacet will be below MINAMOUN...
Reentrancy vulnerability in Basket contract's initialize() method.
Handle broccolirob Vulnerability details A malicious "publisher" can create a basket proposal that mixes real ERC20 tokens with a malicious ERC20 token containing a reentrancy callback in it's approve method. When the initialize method is called on the newly cloned Basket contract, a method calle...
Basket can be fully drained if the auction is settled within a specific block
Handle Ruhum Vulnerability details Impact The settleAuction function allows someone to settle the auction by transferring funds in a way that the new pending index is fulfilled. As a reward, they are able to take out as many tokens as they want as long as the pending index is fulfilled after that...
Publisher can lock all user funds in the Basket in order to force a user to have their bond burned
Handle TomFrenchBlockchain Vulnerability details Impact All user funds in a basket being held hostage by the publisher Proof of Concept The Basket publisher can propose an auction in order to set new tokens and weights with a 1 day timelock. As part of this call they can set the minIbRatio variab...
Basket publisher can raise licenseFee in an unbounded fashion, stealing other users tokens
Handle TomFrenchBlockchain Vulnerability details Impact Publisher can make licenseFee arbitrarily large and then steal any funds remaining in the basket after 1 day. Proof of Concept On minting or burning basket tokens the handleFees function is called. This mints a number of basket tokens to the...
Front running basket Creation
Handle goatbug Vulnerability details Impact Anyone can front run and create your basket, circumventing paying any initial fees. Proof of Concept Once proposeBasketLicense is called, anyone can subsequently call createBasket using that ID. Factory contract By calling it first you will avoid paying...
Withdrawing bounties after checking balances can lead to the entire basket being drained.
Handle itsmeSTYJ Vulnerability details Impact All funds in the basket can be stolen. Proof of Concept 1. Malicious user creates a smart contract that can interact w/ the auction can call bondForRebalance and settleAuction. 2. Auction is started by the publisher 3. Malicious user uses smart contra...
Reentrancy in settleAuction(): malicious publisher can bypass index timelock mechanism, inject malicious index, and rug the basket
Handle kenzo Vulnerability details The settleAuction function calls withdrawBounty before setting auctionOngoing = false, thereby allowing reentrancy. Impact A malicious publisher can bypass the index timelock mechanism and publish new index which the basket's users won't have time to respond to...
WOWRestro < 1.1 - CSRF Bypass
The plugin does not properly check for CSRF in numerous of its AJAX actions, allowing attacker to make logged in users call them and perform unwanted actions, such as add/remove an item from their basket and empty it as well. To empty a user basket:...
WOWRestro < 1.1 - CSRF Bypass
The plugin does not properly check for CSRF in numerous of its AJAX actions, allowing attacker to make logged in users call them and perform unwanted actions, such as add/remove an item from their basket and empty it as well. PoC To empty a user basket:...
basket-forum.pl XSS vulnerability
Open Bug Bounty ID: OBB-716410 Description| Value ---|--- Affected Website:| basket-forum.pl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...
loobylouyarns.co.uk XSS vulnerability
Open Bug Bounty ID: OBB-600228 Description| Value ---|--- Affected Website:| loobylouyarns.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
visite-kaartjes.be XSS vulnerability
Open Bug Bounty ID: OBB-524437 Description| Value ---|--- Affected Website:| visite-kaartjes.be Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...
asia-basket.com XSS vulnerability
Vulnerable URL: http://www.asia-basket.com/Bahrain/basketball.asp?women=1"...
glanztat.de XSS vulnerability
Vulnerable URL: http://www.glanztat.de/shop/basket.php?ID=0e922bc7ffe40a2e927843c4e790672a...
Anime Kuro Basket HD Wallpaper - Customized SSL, Redefined SSL Common Names verifier, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Anime Kuro Basket HD Wallpaper published at the 'play' market has multiple vulnerabilities...
Drupal Node basket module open redirection vulnerability
Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Node basket is one of the modules that allows nodes to be selected from the current session store for payment operations. A security vulnerability exists in the Drupal Node basket modul...
CVE-2015-3383
Open redirect vulnerability in the Node basket module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...
CVE-2015-3382
Multiple cross-site request forgery CSRF vulnerabilities in the Node basket module for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that 1 add or 2 remove nodes from a basket via unspecified vectors...