Chainlink pricer is using a deprecated API

Lines of code Vulnerability details Impact According to Chainlink's documentation, the latestAnswer function is deprecated. This function might suddenly stop working if Chainlink stop supporting deprecated APIs. And the old API can return stale data. Proof of Concept Tools Used None Recommended...

CVE-2022-29969

The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true...

CVE-2022-29969

The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true...

UBUNTU-CVE-2022-29969

The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true...

CVE-2022-29499

creationtimestamp| type| source ---|---|--- 2022-04-26 07:47:52+00:00| seen| https://t.me/cibsecurity/41421 2022-06-27 19:30:04+00:00| exploited| https://t.me/truesecator/3104 2022-09-13 15:35:06+00:00| exploited| https://t.me/truesecator/3409 2022-09-14 09:47:43+00:00| seen|...

Missing Validations for the return values of Chainlink Price feeds

Lines of code Vulnerability details Impact You check only the answerThe price after calling the chainlink Chainlink Price feeds in the following lines. In addition, you need to check whether the data is really updated. Proof of Concept Tools Used code review Recommended Mitigation Steps Please ad...

Improper Validation Of Chainlink's latestRoundData Function

Lines of code Vulnerability details Impact When using Chainlink Price feeds, it is important to ensure the price feed data was updated recently. While getting started with chainlink requires just one line of code, it is best to add additional checks for "in production" environments. Here,...

CVE-2022-1364

creationtimestamp| type| source ---|---|--- 2022-04-15 08:56:41+00:00| exploited| https://t.me/cKure/9368 2022-04-15 11:36:01+00:00| exploited| https://t.me/truesecator/2853 2022-04-17 12:32:15+00:00| exploited| https://t.me/CybersecurityCourse/189 2022-04-18 01:07:08+00:00| exploited|...

Deprecated CHAINLINK API usage

Lines of code Vulnerability details Impact Usage of deprecated chainlink function to get collateral price. Proof of Concept The Chainlink API latestAnswer used in the FungibleAssetVaultForDAO contract is deprecated: This method returns the last value but that value cannot be fully updated. New V3...

Use of deprecated oracle API in _collateralPriceUsd

Lines of code Vulnerability details Likelihood low, impact high. The Chainlink latestAnswer function included in IAggregatorV3Interface and called in FungibleAssetVaultForDAOcollateralPriceUsd is considered deprecated and no longer included in the Chainlink API documentation. It's considered best...

Use of deprecated oracle API in _normalizeAggregatorAnswer

Lines of code Vulnerability details Use of deprecated oracle API in normalizeAggregatorAnswer Likelihood low, impact high. The Chainlink latestAnswer function included in IAggregatorV3Interface and called in NFTVaultnormalizeAggregatorAnswer is considered deprecated and no longer included in the...

XSS Injection Vulnerability

Impact Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied. Patches This has been patched in Craft 3.7.29. References https://github.com/craftcms/cms/blob/develop/CHANGELOG.md3729---2022-01-18 For more information If you hav...

GHSA-WF98-VXV9-JQFV XSS Injection Vulnerability

Impact Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied. Patches This has been patched in Craft 3.7.29. References https://github.com/craftcms/cms/blob/develop/CHANGELOG.md3729---2022-01-18 For more information If you hav...

PT-2022-28285

Name of the Vulnerable Software and Affected Versions Craft versions prior to 3.7.29 Description The Feeds widget on the dashboard has an issue where it could be exploited if a malformed feed was supplied, under certain circumstances. Recommendations For versions prior to 3.7.29, update to versio...

[SECURITY] Fedora 34 Update: gitit-0.13.0.0-5.1.fc34

Gitit is a wiki backed by a git, darcs, or mercurial filestore. Pages and uploaded files can be modified either directly via the VCS's command-line too ls or through the wiki's web interface. Pandoc is used for markup processing, so pages may be written in extended markdown, reStructuredText,...

Bugs in Wyze Cams Could Let Attackers Takeover Devices and Access Video Feeds

Three security vulnerabilities have been disclosed in the popular Wyze Cam devices that grant malicious actors to execute arbitrary code and access camera feeds as well as unauthorizedly read the SD cards, the latter of which remained unresolved for nearly three years after the initial discovery...

CVE-2022-26258

creationtimestamp| type| source ---|---|--- 2022-03-28 07:39:58+00:00| seen| https://t.me/cibsecurity/39629 2022-09-07 14:37:32+00:00| seen| MISP/65f9cb29-4429-4318-a02e-084a7f449e16 2022-09-07 15:31:02+00:00| exploited| https://t.me/truesecator/3387 2023-06-14 21:10:04+00:00| seen|...

CVE-2022-1040

creationtimestamp| type| source ---|---|--- 2022-03-25 15:30:39+00:00| seen| https://t.me/cibsecurity/39533 2022-03-27 14:33:12+00:00| seen| https://t.me/BleepingComputer/11671 2022-03-27 19:17:05+00:00| seen| https://t.me/cKure/9191 2022-03-28 10:46:00+00:00| exploited|...

[WP-H3] money-market-contracts/oracle#feed_prices() delayed transaction may disrupt price feeds

Lines of code Vulnerability details The implementation only takes two attributes: asset and price. And the lastupdatedtime of the record will always be set to the current block.time. This makes it possible for the price feeds to be disrupted when the network is congested, or the endpoint is down...

CVE-2022-24990

creationtimestamp| type| source ---|---|--- 2022-03-08 01:43:00+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1615 2022-03-08 13:08:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/5560 2022-03-20 05:23:50+00:00| published-proof-of-concept|...