1170 matches found
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in codeboxr CBX Currency Converter plugin = 3.0.3 versions...
CVE-2023-28747 WordPress CBX Currency Converter Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in codeboxr CBX Currency Converter plugin = 3.0.3 versions...
CVE-2023-28747
The CVE-2023-28747 entry concerns the CBX Currency Converter WordPress plugin (<= 3.0.3). The vulnerability is Cross-Site Request Forgery (CSRF) that can lead to plugin settings leakage/changes. Affected versions are
CVE-2023-28747 WordPress CBX Currency Converter Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in codeboxr CBX Currency Converter plugin = 3.0.3 versions...
WordPress Plugin CBX Currency Converter Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
PT-2023-21933 · Unknown · Cbx Currency Converter
Name of the Vulnerable Software and Affected Versions: CBX Currency Converter plugin versions = 3.0.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web application...
Arbitrary Price Manipulation
vendure is vulnerable to Arbitrary Price Manipulation. The vulnerability is due to the ability to specify an arbitrary currencyCode as a query parameter to an API call, allowing users to select any currencyCode and thus payments made through Mollie and Stripe in that particular currencyCode are...
PT-2023-33067 · Stripe +2 · Stripe +2
Name of the Vulnerable Software and Affected Versions: Vendure versions prior to 2.1.3 Description: The issue allows selecting any currency code, not limited to those assigned to the channel, and completing payments through Mollie and Stripe in that currency. This results in orders being settled ...
U.S. Treasury Sanctions Russian Money Launderer in Cybercrime Crackdown
The U.S. Department of the Treasury imposed sanctions against a 37-year-old Russian woman for taking part in the laundering of virtual currency for the country's elites and cybercriminal crews, including the Ryuk ransomware group. Ekaterina Zhdanova, per the department, is said to have facilitate...
YoroTrooper: Researchers Warn of Kazakhstan's Stealthy Cyber Espionage Group
A relatively new threat actor known as YoroTrooper is likely made up of operators originating from Kazakhstan. The assessment, which comes from Cisco Talos, is based on their fluency in Kazakh and Russian, use of Tenge to pay for operating infrastructure, and very limited targeting of Kazakhstani...
Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan
Cisco Talos assesses with high confidence that YoroTrooper, an espionage-focused threat actor first active in June 2022, likely consists of individuals from Kazakhstan based on their use of Kazakh currency and fluency in Kazakh and Russian. The actor also appears to have a defensive interest in t...
Malicious code in shopify-currency-converter (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cce5f47f0fb8050c5ba0e74637e692ba095f4628070a3087b67db81de6deca0d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8298 Malicious code in shopify-currency-converter (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cce5f47f0fb8050c5ba0e74637e692ba095f4628070a3087b67db81de6deca0d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Blocking assets/shares in escrow
Lines of code Vulnerability details Impact An investor can lose a part of assets or shares due to their blocking in escrow. Proof of Concept Suppose the user decided to invest an amount of assets which is more than typeuint128.max. This can be done by calling the requestDeposit function several...
Not enough valid checks in the Factory.sol
Lines of code Vulnerability details Impact The LiquidityPoolFactory contract is used to deploy LiquidityPools through a controlled newLiquidityPool , however a vital check is omitted. The newLiquidityPool is first called in the PoolManager.sol but it is not restricted to just that, it can also be...
Already allowed pool currency can not be removed
Lines of code Vulnerability details Impact Already allowed pool currency can not be removed. Once a currency is allowed, it can not be removed. Most of the time, the currency will be a stablecoin but in cases where the stablecoin depegs, as seen with USDC three months ago, new liquidity pools for...
CVE-2023-37759
Incorrect access control in the User Registration page of Crypto Currency Tracker CCT before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request...
CVE-2023-37759
Incorrect access control in the User Registration page of Crypto Currency Tracker CCT before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request...
Improper access control
Incorrect access control in the User Registration page of Crypto Currency Tracker CCT before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request...
CVE-2023-37759
Incorrect access control in the User Registration page of Crypto Currency Tracker CCT before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request...