CVE-2022-30711

Improper validation vulnerability in FeedsInfo prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities...

GHSA-C33V-23RX-7QQC Magento 2 Community Edition IDOR Vulnerability

An insecure direct object reference IDOR vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

GHSA-W5Q4-Q7WP-QWW6 Craft CMS XSS Vulnerability

Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS...

Craft CMS XSS Vulnerability

Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS...

CVE-2021-32934

The affected ThroughTek P2P products SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module do not sufficiently protect data...

Design/Logic Flaw

The affected ThroughTek P2P products SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module do not sufficiently protect data...

CVE-2021-32934 ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information

The affected ThroughTek P2P products SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module do not sufficiently protect data...

CVE-2021-32934

Summary of CVE-2021-32934 : Affects ThroughTek P2P SDKs (versions ≤ 3.1.5, any nossl-tag builds) and certain firmware configurations (no AuthKey for IOTC, AVAPI without DTLS, P2PTunnel/RDT) where data between the local device and ThroughTek servers is not properly protected. This results in clear...

CVE-2022-26925

creationtimestamp| type| source ---|---|--- 2022-05-11 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=801 2022-05-11 08:29:32+00:00| exploited| https://t.me/cKure/9501 2022-05-11 16:04:01+00:00| seen| https://t.me/truesecator/2928 2022-05-17 16:15:03+00:00| exploited|...

Oracle data feed is insufficiently validated

Lines of code Vulnerability details description When using Chainlink Price feeds it is important to ensure the price feed data was updated recently. While getting started with chainlink requires just one line of code, it is best to add additional checks for in production environments. findings...

Chainlink pricer is using a deprecated API

Lines of code Vulnerability details Impact According to Chainlink's documentation, the latestAnswer function is deprecated. This function might suddenly stop working if Chainlink stop supporting deprecated APIs. And the old API can return stale data. Proof of Concept Tools Used None Recommended...

CVE-2022-29969

The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true...

CVE-2022-29969

The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true...

UBUNTU-CVE-2022-29969

The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true...

CVE-2022-29499

creationtimestamp| type| source ---|---|--- 2022-04-26 07:47:52+00:00| seen| https://t.me/cibsecurity/41421 2022-06-27 19:30:04+00:00| exploited| https://t.me/truesecator/3104 2022-09-13 15:35:06+00:00| exploited| https://t.me/truesecator/3409 2022-09-14 09:47:43+00:00| seen|...

Missing Validations for the return values of Chainlink Price feeds

Lines of code Vulnerability details Impact You check only the answerThe price after calling the chainlink Chainlink Price feeds in the following lines. In addition, you need to check whether the data is really updated. Proof of Concept Tools Used code review Recommended Mitigation Steps Please ad...

Improper Validation Of Chainlink's latestRoundData Function

Lines of code Vulnerability details Impact When using Chainlink Price feeds, it is important to ensure the price feed data was updated recently. While getting started with chainlink requires just one line of code, it is best to add additional checks for "in production" environments. Here,...

CVE-2022-1364

creationtimestamp| type| source ---|---|--- 2022-04-15 08:56:41+00:00| exploited| https://t.me/cKure/9368 2022-04-15 11:36:01+00:00| exploited| https://t.me/truesecator/2853 2022-04-17 12:32:15+00:00| exploited| https://t.me/CybersecurityCourse/189 2022-04-18 01:07:08+00:00| exploited|...

Use of deprecated oracle API in _normalizeAggregatorAnswer

Lines of code Vulnerability details Use of deprecated oracle API in normalizeAggregatorAnswer Likelihood low, impact high. The Chainlink latestAnswer function included in IAggregatorV3Interface and called in NFTVaultnormalizeAggregatorAnswer is considered deprecated and no longer included in the...

Use of deprecated oracle API in _collateralPriceUsd

Lines of code Vulnerability details Likelihood low, impact high. The Chainlink latestAnswer function included in IAggregatorV3Interface and called in FungibleAssetVaultForDAOcollateralPriceUsd is considered deprecated and no longer included in the Chainlink API documentation. It's considered best...