PT-2023-32501 · Unknown · Phpgurukul Restaurant Table Booking System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Restaurant Table Booking System version 1.0 Description: A problematic vulnerability was found in the PHPGurukul Restaurant Table Booking System, affecting an unknown functionality of the file booking-details.php of the component...

Cisco Secure Web Appliance XSS (cisco-sa-esa-sma-wsa-xss-cP9DuEmq)

According to its self-reported version, Cisco Secure Web Appliance is affected by cross-site scripting vulnerabilities. The vulnerability is due to insufficient validation of user input. An attacker could exploit this by persuading a user of an affected interface to click a crafted link. A...

A lot with a lots.sdAmount less than the bidIncrement cannot be bid on

Lines of code Vulnerability details M-01 A lot with a lots.sdAmount less than the bidIncrement cannot be bid on Impact Everyone can create a lot by calling Auction.createLot with any arbitrary amount they specify. However, creating a lot with a low sdAmount can result in two potential issues: Whe...

Attacker can frontrun user bid with wrong lotId and create the lot with that lotId, forcing the user to take a big loss

Lines of code Vulnerability details Impact User takes a huge loss by getting 1 SD token, but bidding an amount possibly much bigger. Attackers are incetivized to perform this if they are ETHx holders and want to increase the value of their tokens. Proof of Concept When a user adds a bid to the...

VSFTPD 2.3.2 and Earlier STAT Denial of Service

This module triggers a Denial of Service condition in the VSFTPD server in versions before 2.3.3 tested on 2.3.0, 2.3.1, and 2.3.2. Version 2.3.3 and higher should not be vulnerable. Module Options msf use auxiliary/dos/ftp/vsftpd232 msf auxiliaryvsftpd232 show actions ...actions... msf...

Cisco Identity Services Engine 3.x < 3.2P1 Arbitrary File Download (cisco-sa-ise-file-dwnld-Srcdnkd2)

According to its self-reported version, Cisco Identity Services is affected by a vulnerability in the web-based management interface. These allow an authenticated, remote attacker to download arbitrary files from the file system of an affected device. These vulnerabilities are due to insufficient...

Shortfall.sol#initialize's waitForFirstBidder and nextBidderBlockLimit too short

Lines of code Vulnerability details Impact File: Shortfall.sol 147 waitForFirstBidder = 100; 148 nextBidderBlockLimit = 10; Binance Smart Chain has a block time of around 3 seconds. This could lead to an attacker blocking other bids to bid for the token at a low price. Proof of Concept Tools Used...

Bad debt auctions can be DoSed forever

Lines of code Vulnerability details Vulnerability Details For function Shortfall::placeBid in shortfall contract on L183 and L190 , the previous highest bidder’s funds stored in the shortfall contract has to be sent back to the bidder. This operation has to be successful before any new bid can be...

Shortfall.sol#placeBid does not limit the bid spread

Lines of code Vulnerability details Impact Shortfall.solplaceBid does not limit the bid spread. The attacker can increase the price by a small amount each time causing the auction to never stop. Proof of Concept Tools Used manual Recommended Mitigation Steps limit the bid spread Assessed type DoS...

inDrive: Rider can forcefully get passenger's order accepted resulting in multiple impacts including PII reveal and more mentioned in the report.

A vulnerability was found in the customer order flow that allowed a driver to forcefully accept an order on behalf of a passenger, bypassing the normal negotiation process. This allowed the driver to set the ride price without following the built-in fare calculation algorithm...

Cisco Firepower Threat Defense Software SSL Decryption Policy Bleichenbacher Attack (cisco-sa-ftd-tls-bb-rCgtmY2)

A vulnerability in the TLS handler of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to gain access to sensitive information. This vulnerability is due to improper implementation of countermeasures against a Bleichenbacher attack on a device that uses...

Massive Ad Fraud Scheme Targeted Over 11 Million Devices with 1,700 Spoofed Apps

Researchers have shut down an "expansive" ad fraud scheme that spoofed more than 1,700 applications from 120 publishers and impacted roughly 11 million devices. "VASTFLUX was a malvertising attack that injected malicious JavaScript code into digital ad creatives, allowing the fraudsters to stack...

createLien() The first LienToken does not check for liquidationInitialAsk and maxPotentialDebt

Lines of code Vulnerability details Impact Illegal liquidationInitialAsk and maxPotentialDebt may result in bids amount do not cover the debt Proof of Concept With the current implementation, the first LienToken does not check liquidationInitialAsk and maxPotentialDebt function appendStack...

CVE-2014-125063

A vulnerability was found in ada-l0velace Bid and classified as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is abd71140b8219fa8741d0d8a57ab27d5bfd34222. It is recommended to apply a patch to fix this issue. The...

Sql injection

A vulnerability was found in ada-l0velace Bid and classified as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is abd71140b8219fa8741d0d8a57ab27d5bfd34222. It is recommended to apply a patch to fix this issue. The...

CVE-2014-125063 ada-l0velace Bid sql injection

A vulnerability was found in ada-l0velace Bid and classified as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is abd71140b8219fa8741d0d8a57ab27d5bfd34222. It is recommended to apply a patch to fix this issue. The...

CVE-2014-125063

The CVE-2014-125063 entry concerns ada-l0velace Bid with a reported SQL injection in an unknown processing path. The vulnerability is described as critical, with a patch identified as abd71140b8219fa8741d0d8a57ab27d5bfd34222 and an assigned vulnerability ID VDB-217625. Public documents consistent...

CVE-2014-125063 ada-l0velace Bid sql injection

A vulnerability was found in ada-l0velace Bid and classified as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is abd71140b8219fa8741d0d8a57ab27d5bfd34222. It is recommended to apply a patch to fix this issue. The...

Bid Project SQL注入漏洞

Bid Project is a project of ada-l0velace individual developer. Bid Project suffers from a SQL injection vulnerability. An attacker could exploit this vulnerability to perform a sql injection attack...

PT-2023-10133 · Unknown · Ada-L0Velace Bid

Name of the Vulnerable Software and Affected Versions: ada-l0velace Bid affected versions not specified Description: A critical issue was found in the software, affecting some unknown processing, which leads to sql injection. Recommendations: At the moment, there is no information about a newer...