CVE-2023-35159

creationtimestamp| type| source ---|---|--- 2023-06-23 22:33:44+00:00| published-proof-of-concept| https://t.me/cibsecurity/65479...

fief-server Server-Side Template Injection vulnerability

Server-Side Template Injection Overview of the Vulnerability Server-Side Template Injection SSTI is a vulnerability within application templating engines where user input is improperly handled and is embedded into the template, possibly leading code being executed. An attacker can use SSTI to...

CVE-2023-35840

creationtimestamp| type| source ---|---|--- 2023-06-23 10:59:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8540 2023-06-24 16:36:08+00:00| published-proof-of-concept| https://t.me/crackcodes/3726 2023-06-24 16:36:58+00:00| published-proof-of-concept|...

Lack of deep validation

Lines of code Vulnerability details Impact The validate functions are just checking the parameters type without checking any further information Proof of Concept They are just trying to cast the value with i.TYPE and check if there is an error. There is no further validations e. g...

Pre-defined limit is different from the spec.

Lines of code Vulnerability details Impact In the spec, the pre-defined limit of ETH is 0.01 ETHs. But the actual limit in the code is not 0.01 ETH which could result in misleading. Proof of Concept In the spec, it said that the pre-defined limit of ETH is 0.01 ETHs For risk management purposes, ...

D

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps Assessed...

The last error in swap.go#swapCoins() was not handled correctly.

Lines of code Vulnerability details Impact If the last statement of the swapCoins function returns an error, the swap is only half completed, i.e. only the user's assets are deducted transferred to the pool, but the user's bought assets are not sent to the user, resulting in a loss of the user's...

Bypass check with one non-standard denom

Lines of code Vulnerability details Impact Wrong conditional when checking for non-standard denoms Proof of Concept The conditional is used to sanitize if the denom1 and denom2 are indeed standardDenom see the error in the next line. However, the condition can be bypassed with one of them being...

Missing store revert in case of erc20 conversion error can lead to loss of funds

Lines of code Vulnerability details Impact The module is expected to have no changes in case a erc20 conversion failed. It was implemented by swallowing the error with a log and continuing with the flow finishing the IBC transfer. This is the relevant code section: if , err =...

GetPoolByLptDenom function does not check if lptDenom string is valid

Lines of code Vulnerability details Impact To check if the lptDenom string is valid The GetPoolByLptDenom function in the keeper package do that job so that is the problem, So an attacker can pass in a malicious lptDenom string that would cause the function to return a non-existent liquidity pool...

CVE-2023-35925

creationtimestamp| type| source ---|---|--- 2023-06-22 10:47:22+00:00| published-proof-of-concept| https://github.com/IntellectualSites/FastAsyncWorldEdit/security/advisories/GHSA-whj9-m24x-qhhp...

CVE-2023-30347

creationtimestamp| type| source ---|---|--- 2023-06-22 09:44:11+00:00| published-proof-of-concept| https://t.me/crackcodes/3716 2023-06-22 10:11:29+00:00| published-proof-of-concept| Telegram/oHP8R6rQpO8E4nEBBBMmcV3PiuGU9AfrSsjxuqFDC6WptA 2023-06-22 11:01:08+00:00| published-proof-of-concept|...

CVE-2023-32412

creationtimestamp| type| source ---|---|--- 2023-06-22 05:41:46+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8529...

CVE-2023-35169

creationtimestamp| type| source ---|---|--- 2023-06-21 18:58:05+00:00| published-proof-of-concept| https://github.com/Webklex/php-imap/security/advisories/GHSA-47p7-xfcc-4pv9...

Insufficient Validation of Addresses Vulnerability

Lines of code Vulnerability details Summary The code suffers from an insufficient validation of addresses vulnerability. Although it uses the sdk.AccAddressFromBech32 function to convert addresses from Bech32 format to sdk.AccAddress, it fails to validate the addresses for their validity and...

RecollateralizationLibP1.basketRange calculates deficit incorrectly

Lines of code Vulnerability details Impact RecollateralizationLibP1.basketRange calculates deficit incorrectly. so recollateralization may be not efficient. Proof of Concept RecollateralizationLibP1.basketRange calculates range.bottom for pessimistic case. // tok = tok/BU BU uint192 anchor =...

AssetRegistry.swapRegistered can be called with low gas to make basket be disabled

Lines of code Vulnerability details Impact Attacker can disable basket, when swapping or unregistering not basket asset. Proof of Concept AssetRegistry.swapRegistered and AssetRegistry.unregister are both functions that can be called by governance only. It's possible that after proposal is passed...

CVE-2023-35170

creationtimestamp| type| source ---|---|--- 2023-06-20 18:36:50+00:00| published-proof-of-concept| https://github.com/BishopFox/sliver/security/advisories/GHSA-8jxm-xp43-qh3q...

Exploit for Code Injection in Vmware Spring_Framework

Spring4Shell Spring4Shell CVE-2022-22965 Proof Of Concept wi...

CVE-2021-30357

creationtimestamp| type| source ---|---|--- 2023-06-20 11:01:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8521 2023-06-22 22:39:42+00:00| published-proof-of-concept| https://t.me/dilagrafie/3089...