CVE-2023-2822 Ellucian Ethos Identity logout cross site scripting

A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

Ellucian 跨站脚本漏洞

Ellucian is Ellucian's open and flexible technology ecosystem supporting SaaS. A cross-site scripting vulnerability exists in Ellucian Ethos Identity versions prior to 5.10.5, which stems from the presence of an unknown function in the file /cas/logout that leads to cross-site scripting via the...

PT-2023-21637 · Ellucian · Ellucian Ethos Identity

Name of the Vulnerable Software and Affected Versions: Ellucian Ethos Identity versions up to 5.10.5 Description: A problematic issue has been found in Ellucian Ethos Identity, where the manipulation of the url argument in an unknown function of the file /cas/logout leads to cross-site scripting...

Ethos stil using LUSD (not ERN) will lead to confusion and ambiguity of the protocol resulting uncountable risk for the project

Lines of code Vulnerability details Impact Ethos stil using LUSD not ERN will lead to confusion and ambiguity of the protocol resulting uncountable risk for the project Proof of Concept Ethos is a fork project of Liquity with additional changes, supporting multi collateral tokens. There are some...

Incorrect Price-Feed Failsafe System

Lines of code https://github...

Inexistent Prevention of Duplicates

Lines of code Vulnerability details Impact The CollateralConfig::initialize function which instantiates the contract's state does not prevent duplicate collateral entries from being specified which can occur undetected. If the system is setup with duplicate collateral entries, the Ethos Core...

ReaperVaultERC4626.sol is not EIP-4626 compliant

Lines of code Vulnerability details Impact Other protocols integrated with Ethos Reserve may mistakenly assume that its function complies with EIP-4626. Therefore, this may lead to integration issues in the future, which could result in various problems for both parties. Proof of Concept All...

Inexistent Slippage Evaluation

Lines of code Vulnerability details Impact The ecosystem of Ethos Reserve contains an EIP-4626 implementation of a vault meant to be integrated by its LUSD lending and borrowing system. As per the standard's Security Considerations itself, slippage checks need to be introduced at the integration...

Using _freefunds() to calculate share price lead to shares miscalculations and could benefit treasury

Lines of code Vulnerability details Impact Function freeFunds calculates the amount of free funds available after profit locking and it's used to for calculating share price, issuing shares during deposit, or burning shares during withdrawal. Value returned by freeFunds is time-dependant, because...

Lack of logic to mint OATH within the CommunityIssuance#issueOath(), which results in that entire OATH insurance mechanism will not work properly

Lines of code Vulnerability details Impact OATH will be never minted issued when the the CommunityIssuanceissueOath would be called. As a result, OATH will be never provided to the market. This results in that the treasury will be never able to buy the OATH from the market. This lead to a bad...

ethos-europe.eu Cross Site Scripting vulnerability OBB-3079030

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

MAL-2022-2878 Malicious code in ethos-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb452222ed03986bb9089d8abc2e64ad8100d354a46b6daa90ebb4494b42e718 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethos-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb452222ed03986bb9089d8abc2e64ad8100d354a46b6daa90ebb4494b42e718 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ethos.lctcs.edu Cross Site Scripting vulnerability OBB-2278105

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ethos.westfield.ma.edu Cross Site Scripting vulnerability OBB-2278086

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ethos-test.lctcs.edu Cross Site Scripting vulnerability OBB-2278069

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ethos.alfredstate.edu Cross Site Scripting vulnerability OBB-2277949

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ethos-marketing.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1095502 Security Researcher geeknik Helped patch 8826 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting ethos-marketing.com websit...

ethoswatches.com XSS vulnerability

Vulnerable URL: https://www.ethoswatches.com/brands/women.html?p="3=10000-20000 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 22.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 58898 VIP website status:| No Coordinated Disclosure...

LinkedIn Latest Contributor to Breach Fatigue

The obvious takeaway from last week’s LinkedIn data breach revelation where we learned hackers were selling 117 million LinkedIn usernames, email addresses and passwords from a 2012 breach is, change your passwords-and often. The not so obvious takeaways come from noted security expert Troy Hunt,...