152 matches found
PT-2024-33483 · WordPress · Canto
Name of the Vulnerable Software and Affected Versions: Canto plugin for WordPress versions up to, and including, 3.0.8 Description: The issue allows unauthenticated attackers to include remote files on the server, resulting in code execution. This is achieved via the abspath parameter and require...
Canto <= 3.0.8 - Unauthenticated Remote File Inclusion
Description The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required...
CVE-2024-25096
Improper Control of Generation of Code 'Code Injection' vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7...
CVE-2024-25096
Improper Control of Generation of Code 'Code Injection' vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7...
CVE-2024-25096 WordPress canto plugin <= 3.0.7 - Unauth. Remote Code Execution (RCE) vulnerability
Improper Control of Generation of Code 'Code Injection' vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7...
CVE-2024-25096 WordPress canto plugin <= 3.0.7 - Unauth. Remote Code Execution (RCE) vulnerability
Improper Control of Generation of Code 'Code Injection' vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7...
WordPress Plugin Canto 代码注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...
PT-2024-20744 · Canto · Canto
Name of the Vulnerable Software and Affected Versions: Canto versions 3.0.7 and earlier Description: The issue is related to improper control of generation of code, also known as 'Code Injection'. This allows for code injection in Canto Inc.'s Canto. Recommendations: For versions 3.0.7 and earlie...
Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE)
Exploit Title: Wordpress Plugin Canto " def createadminfilelocaldir, localshell=None: if not os.path.existslocaldir: os...
Wordpress Canto Plugin < 3.0.5 - Remote File Inclusion and Remote Code Execution Exploit
Exploit Title: Wordpress Plugin Canto " def createadminfilelocaldir, localshell=None: if not os.path.existslocaldir: os.makedirslocaldir If a local shell is p...
WordPress Canto Remote Shell Upload
Exploit Title: Wordpress Plugin Canto " def createadminfilelocaldir, localshell=None: if not os.path.exis...
Canto < 3.0.7 - Unauthenticated RCE
Description The plugin is vulnerable to Remote Code Execution via the 'abspath' parameter due to the use of the includeonce statement on the parameter allowing remote file inclusion. This makes it possible for unauthenticated attackers to execute code on the server...
WordPress Canto Plugin <= 3.0.6 is vulnerable to Remote Code Execution (RCE)
Software Canto Type Plugin Vulnerable versions = 3.0.6 Fixed in 3.0.7 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-25096 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 5a102fd4265b Credits Rodrigo Escobar ipax Required privilege...
update_market() market weight incorrect
Lines of code Vulnerability details Vulnerability details in updatemarket We need to get the weight percentage of the corresponding market epoch through gaugeController Then allocate cantoPerBlockepoch according to the percentage The main logic code is as follows: function updatemarketaddress...
Loss of precission when calculating the accumulated CANTO per share
Lines of code Vulnerability details Impact When calculating the amount of CANTO per share in updatemarket, dividing by 1e18 in cantoReward and multiplying by the same value in accCantoPerShare rounds down the final value, making the amount of rewards users will receive be less than expected. Proo...
BLOCK_EPOCH and WEEK should not be mixed
Lines of code Vulnerability details Impact Rewards and voting weights are aligned on a weekly basis. In contract LendingLedger, reward is recorded for each epochblock.number. However, when calling gaugerelativeweightwrite, we should actually pass a timestamp, or the weight cannot be retrieved...
withdrawCarry will not work
Lines of code Vulnerability details Description When calculating the amount of interest gathered this calculation is done: asD::withdrawCarry: File: asD/src/asD.sol 73: uint256 exchangeRate = CTokenInterfacecNote.exchangeRateCurrent; // Scaled by 1 10^18 - 8 + Underlying Token Decimals, i.e. 10^2...
The withdrawCarry() function always reverts because of an incorrect assumption.
Lines of code Vulnerability details Impact The Compound protocol's CTokens have 8 decimal places, but the team mistakenly believed that cNote also had only 8 decimal places. However, it was discovered that cNote actually has 18 decimal places. This discrepancy caused the withdrawCarry function to...
Exploit for CVE-2023-3452
CVE-2023-3452-PoC - Wordpress Plugin Canto 3.0.5 - Remote...
Canto < 3.0.5 - Unauthenticated Remote File Inclusion
Description The Canto WordPress plugin was affected by an Unauthenticated File Inclusion security vulnerability...