Cross-site Scripting (XSS)

com.liferay:com.liferay.layout.admin.web is vulnerable to cross-site scripting. The library does not properly escape the COLLECTIONNAME parameter before it output to the front end, allowing an attacker to inject and execute malicious javascript...

Miners Can Manipulate tx.gasprice to Drain Users' Wallets in postIncomingMessages()

Lines of code Vulnerability details Impact The postIncomingMessages function is used to broadcast signed data indicating that a funds on an schain will be moved to mainnet. While the function performs proper signature verification, it doesn't prevent any arbitrary user from frontrunning the...

WordPress Page Builder Sandwich – Front-End Page Builder plugin <= 4.5.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Page Builder Sandwich – Front-End Page Builder plugin versions = 4.5.5. Solution Update the WordPress Page Builder Sandwich – Front-End Page Builder plugin to the latest available version at least 4.5....

WordPress Front End PM plugin < 11.3.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Front End PM plugin versions 11.3.4. Solution Update the WordPress Front End PM plugin to the latest available version at least 11.3.4...

WordPress Front End PM plugin < 11.3.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Front End PM plugin versions 11.3.4. Solution Update the WordPress Front End PM plugin to the latest available version at least 11.3.4...

permitAndMulticall() May Be Used to Steal Funds Or as a Denial Of Service if _from Is Not The Message Sender

Lines of code Vulnerability details Impact When the from address is not the msg.sender multiCall will be made on behalf of the msg.sender. As a result each of the functions called by multiCall will be made on behalf of msg.sender and not from. If functions such as transfer or unstake are called...

TurboRouter: deposit(), mint(), createSafeAndDeposit() and createSafeAndDepositAndBoost() functions may be vulnerable to FRONT-RUN attack

Lines of code Vulnerability details Impact The TurboRouter contract inherits from the PeripheryPayments contract. To execute the deposit, mint, createSafeAndDeposit and createSafeAndDepositAndBoost functions of the TurboRouter contract, the user needs to first execute the pullToken and approve...

NestedFactory.addOperator/removeOperator have no effect until importOperators

Lines of code Vulnerability details Impact addOperator/removeOperator being run alone don't have any effect, as the cache is used in operations, which is only updated when an implementation is added or removed via importOperators. If an operation is added via addOperator, but importOperators isn'...

TikTok: Instance Page DOS within Organization on TikTok Ads

A vulnerability was found on the Instance Page service of TikTok Ads, which would allow an Operator to perform a Denial of Service DoS on the Front End of only their own organization. We thank @arsenelupin for reporting this to our team...

Owner could frontrun with higher price

Lines of code Vulnerability details Impact User can buy tokenOut at price X and be front-run by the owner by setting a higher price. Proof of Concept Recommended Mitigation Steps Changes in price by the owner should have some time lock to protect the buyer from frontrunning --- The text was updat...

Lack of access control in the parameterize function of proposal contracts

Handle shw Vulnerability details Impact Most of the proposal contracts have a parameterize function for setting the proposal parameters, and these functions are protected only by the notCurrent modifier. When the proposal is proposed through a lodgeProposal transaction, an attacker can front-run...

makeProposal can be front run with an arbitrary proposal modifications, enabling griefing attack

Handle hyh Vulnerability details Impact Griefing attack is possible for makeProposal as proposal details can be modified by anyone. Proposal setters have no access controls, requiring only that proposal be not current, so when makeProposal is executed after the preparation phase an attacker can...

sNOTE.sol#_mintFromAssets() Lack of slippage control

Handle WatchPug Vulnerability details ttps://github.com/code-423n4/2022-01-notional/blob/d171cad9e86e0d02e0909eb66d4c24ab6ea6b982/contracts/sNOTE.solL195-L209 BALANCERVAULT.joinPoolvalue: msgValue NOTEETHPOOLID, addressthis, addressthis, // sNOTE will receive the BPT IVault.JoinPoolRequest assets...

ConvexYieldWrapper wrap can be front-run

Handle hyh Vulnerability details Impact Now wrap operate with tokens that were sent to the contract before, expecting a user to deal with any front running issues. If a user will not make actual token transfer and wrap atomic, i.e. will not run them from an another contract within one transaction...

CVE-2021-46377

There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.phpviewUser...

CVE-2021-46377

There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.phpviewUser...

Sql injection

There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.phpviewUser...

CVE-2021-46377

CSZ CMS 1.2.9 contains a front-end SQL injection vulnerability exploitable through cszcms/controllers/Member.php#viewUser. The issue is documented across multiple sources (CVE-2021-46377) with high severity (CVSSv3.1 base score 9.8; impact to confidentiality, integrity, and availability) and a ne...

CVE-2021-46377

There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.phpviewUser...

LaunchEvent's createPair can be cause to always revert

Handle UncleGrandpa925 Vulnerability details Impact This issue impacts all LaunchEvent, forcing the issuer to write additional contracts to be able to createPair in LaunchEvent else it will always revert. Issue & Proof of Concept In LaunchEvent.sol, the function createPair is supposed to be calle...