5251 matches found
CVE-2004-1464
creationtimestamp| type| source ---|---|--- 2023-06-14 21:10:02+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-03 14:06:52+00:00| seen| https://t.me/arpsyndicate/950 2024-12-24 20:34:28+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971820 2025-02-23 02:09:58+00:00| see...
getPORFeedData() doesn't validate price feed answers (totalETHBalanceInInt and totalETHXSupplyInInt) before casting to uint256
Lines of code Vulnerability details Impact If a negative value is returned 0 from chainlink oracle and the value is cast to type uint256, the resulting value will be the unsigned representation of that value which will be an inaccurate price. Also, cases where sdprice can't be less than 0 will...
No stale data check on data being read from POR feed
Lines of code Vulnerability details Impact Stale data of exchange rate data being used protocol, resulting in loss in terms of ETHX being minted at stale exchange rate which won't have accounted for new reward Recommended Mitigation Steps Check lastUpdatedAt timestamp and that it is within...
Oracle data is not sufficiently validated
Lines of code Vulnerability details Impact The retrieved price from the oracle can be stale value or outdated and used anyways as a valid data. The usage of such data can impact on how the further logics of that price are implemented. Proof of Concept File: StaderOracle.sol function getPORFeedDat...
CVE-2023-2503
CVE-2023-2503 affects the 10Web Social Post Feed WordPress plugin (pre-1.2.9). Root cause: the plugin does not sanitize/escape certain parameters before output, enabling a Reflected XSS under admin contexts. Impact per sources: MEDIUM (CVSS 3.1 base 6.1). Remediation: upgrade to plugin version 1....
CVE-2023-2503 10WebSocial < 1.2.9 - Reflected XSS
The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Overview Affected versions of this package are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the setheader and...
WordPress plugin 10Web Social Post Feed 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
WordPress Kebo Twitter Feed Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF)
Software Kebo Twitter Feed Type Plugin Vulnerable versions = 1.5.12 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-34384 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID c50e5aab5720 Credits István Márton...
CVE-2023-34225
In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible...
CVE-2023-34225
In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible...
Cross site scripting
In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible...
CVE-2023-34225
In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible...
CVE-2023-34225
In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible...
Cross site scripting
Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is...
CVE-2023-33186 Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip
Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is...
Cross-site Scripting (XSS)
craftcms/cms is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the body.twig and links.twig due to the improper sanitization in the text attribute, which allows an attacker to inject and execute malicious javascript through the RSS feed...
Zulip 跨站脚本漏洞
Zulip is a powerful open source group chat application from Zulip, Inc. for combining the immediacy of real-time chat with the productivity benefits of threaded conversations. A security vulnerability exists in Zulip version 7.0-beta1, 7.0-beta2, which stems from a problem with the tooltip of the...
PT-2023-24203 · Unknown · Zulip Server
Name of the Vulnerable Software and Affected Versions: Zulip Server versions 7.0-beta1 through 7.0-beta2 and the main development branch from May 2, 2023 and later Description: The issue is related to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send...
cpp-httplib 注入漏洞
cpp-httplib is an HTTP/HTTPS server and client library written in C++. A security vulnerability exists in cpp-httplib versions prior to 0.12.4 that stems from vulnerability to CRLF injection, which can lead to logic errors and other misbehavior...