Bond Redemption is lower than intended

Lines of code Vulnerability details Impact Bonds redemption does not correspond to protocol intention leading to lesser ETH redeemed Proof of Concept Once the bond reaches maturity and the user initiates the redemption process by calling "redeem," it's possible for the user to receive a gain that...

_weight - voter.deductions can revert in underflow when counting the vote

Lines of code Vulnerability details Impact weight - voter.deductions can revert in underflow when counting the vote Proof of Concept In the current implementation, when a voting, the function countVote is triggered, this function is overriden in the function GovernorCountingOverridable.sol weight...

CVE-2022-43710

Interactive Forms IAF in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery CSRF because the unique token could be deduced using the names of all input fields...

_totalWithdrawn VALUE DOES NOT INCLUDE THE _fee AMOUNT THUS INTRODUCING ACCOUNTING ERROR

Lines of code Vulnerability details Impact In the PrizePool.ClaimPrize function is used to claim the rewards of the verified winner. Here when sending the Prize amount to the winner a fee amount is deducted from it as shown below: uint256 amount = tierLiquidity.prizeSize - fee; And this amount is...

CVE-2023-1852

A vulnerability classified as problematic was found in SourceCodester Online Payroll System 1.0. This vulnerability affects unknown code of the file /admin/deductionedit.php. The manipulation of the argument description leads to cross site scripting. The attack can be initiated remotely. The...

PT-2023-17284 · Unknown · Sourcecodester Online Payroll System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Payroll System version 1.0 Description: A problematic issue was found in the SourceCodester Online Payroll System. This issue affects the file /admin/deduction edit.php, where the manipulation of the description argument...

Online Payroll System 跨站脚本漏洞

Online Payroll System is a system for distributing payroll online. A cross-site scripting vulnerability exists in Online Payroll System, which stems from the lack of effective filtering and escaping of user-supplied data in /admin/deductionedit.php, and can be exploited by attackers to execute...

Incorrect calculation of usedFunds in LiquidityPool leads to lower than expected token price

Lines of code Vulnerability details In LiquidityPool.sol, the functions openLong, closeLong, openShort and closeShort do not deduct hedgingFees from usedFunds to offset the hedgingFees that was added due to hedge. Impact The missing deduction of hedgingFees will increase the usedFunds in...

CVE-2023-26476

XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to LiveTableResults and WikisLiveTableResultsMacros. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version ...

GSD-2023-1002127 ipv6: raw: Deduct extension header length in rawv6_push_pending_frames

ipv6: raw: Deduct extension header length in rawv6pushpendingframes This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.89 by commit...

Lack Of A Safety Mechanism For Deducting Selling Fees

Lines of code Vulnerability details Vulnerability Details The transferFees function of the BlurExchange contract calculates and transfers selling fees to multiple fee receivers as shown in L477 - 478 in code snippet 1. The selling fees would be deducted from the selling price. In other words, a...

High privilege of setWithholdRatio function

Lines of code Vulnerability details Impact With the setWithholdRatio function, most of the funds can be authorized to be confiscated, such authority is too high and can confuse users, If this authority is to be used for commission deduction, it should be clearly stated. Proof of Concept /// @noti...

Fee is being deducted when Put is expired and not when it is exercised.

Lines of code Vulnerability details Impact Fee is being deducted when Put is expired and not when it is exercised in PuttyV2.sol. Comment section of the setFee function mentions "fee rate that is applied on exercise" which signifies that the fee amount is meant to be deducted from strike only whe...

CVE-2022-28016

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\deductionedit.php...

CVE-2022-28016

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\deductionedit.php...

CVE-2022-28016

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\deductionedit.php...

XVader.sol : loss of user funds during 'leave' function

Handle shri4net Vulnerability details Impact Unintended Fee is charged to user while using 'leave' function in XVader.sol as part of the voting/governance. Proof of Concept Ref contracts/x-vader/XVader.sol, function leave Ref contracts/tokens/Vader.sol, function transfer Example, User locks 100...

Unclaimed rewards are not deducted when reclaiming an incentive

Handle broccoli Vulnerability details Impact The reclaimIncentive function of ConcentratedLiquidityPoolManager does not update the rewardsUnclaimed variable after some rewards are reclaimed. Thus, an attacker could add an incentive with a corresponding token, such as DAI, and reclaim the incentiv...

Biometric Shift Employee Management System Cross-Site Scripting Vulnerability (CNVD-2018-01397)

Biometric Shift Employee Management System is an employee management system. A cross-site scripting vulnerability exists in Biometric Shift Employee Management System. The vulnerability can be exploited via the amount parameter in the index.php?user=additiondeduction request...

OpenJDK: non-constant time GCM authentication tag comparison (JCE, 8143945)

It was discovered that the GCM Galois/Counter Mode implementation in the JCE component in OpenJDK used a non-constant time comparison when comparing GCM authentication tags. A remote attacker could possibly use this flaw to determine the value of the authentication tag...