CVE-2023-46964

Cross Site Scripting XSS vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering...

Cross site scripting

Cross Site Scripting XSS vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering...

PT-2023-27702 · Kerawen · Kerawen

Name of the Vulnerable Software and Affected Versions: Kerawen versions prior to 2.5.1 Description: The issue is related to a SQL injection vulnerability. It occurs via the ocs id cart parameter at the KerawenDeliveryModuleFrontController::initContent function. Recommendations: For versions prior...

CVE-2023-46964

Cross Site Scripting XSS vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering...

Hillstone Next Generation FireWall SG-6000-e3960 Security Vulnerability

Hillstone Networks Next Generation FireWall SG-6000-e3960 is a Web firewall from Hillstone Networks, China. A security vulnerability exists in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5. A remote attacker could exploit this vulnerability to execute arbitrary code by using front-end...

PT-2023-30274 · Hillstone · Hillstone Next Generation Firewall Sg-6000-E3960

Name of the Vulnerable Software and Affected Versions: Hillstone Next Generation FireWall SG-6000-e3960 version 5.5 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code. This is due to the use of front-end filtering instead of back-end filtering...

CVE-2023-46964

Cross Site Scripting XSS vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering...

CVE-2023-46964

CVE-2023-46964 affects Hillstone Next Generation Firewall SG-6000-e3960 (v5.5). The issue is a Cross Site Scripting (XSS) vulnerability due to using front-end filtering instead of back-end filtering, enabling a remote attacker to execute arbitrary code. Impact is described as arbitrary code execu...

MEV bot can frontrun user's repayment to liquidate user first when the OmniPool is unpaused

Lines of code Vulnerability details Impact MEV bot can frontrun user's repayment to liquidate user first when the OmniPool is unpaused Proof of Concept this report tries to combine a few issue 1. when OmniPool is paused, interest is still accuring 2. when OmniPool is paused, user cannot repay 3...

CVE-2023-43139

An issue in franfinance before v.2.0.27 allows a remote attacker to execute arbitrary code via the validation.php, and controllers/front/validation.php components...

CVE-2023-43139

An issue in franfinance before v.2.0.27 allows a remote attacker to execute arbitrary code via the validation.php, and controllers/front/validation.php components...

CVE-2023-43139

An issue in franfinance before v.2.0.27 allows a remote attacker to execute arbitrary code via the validation.php, and controllers/front/validation.php components...

CVE-2023-45899

An issue in the component SuperUserSetuserModuleFrontController:init of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image zoom and other features. A security vulnerability exists in PrestaShop idnovate superuser before version v2.4.2, whic...

bad Actor can block the operation of mint by creating duplicate order by frunt runing original order

Lines of code Vulnerability details Impact bad Actor can block the operation of mint by creating duplicate order by frunt runing original order So basically the contracts are doing orders by users RFQ to system whether by API or front end. and make the mint process the problem is in the contract...

Temporary DOS attack on users minting and redeeming big amount using EthenaMinting.sol

Lines of code Vulnerability details Impact The users redeeming and minting using EthenaMinting.sol with a large amount can be vulnerable to DOS attack. Proof of Concept There is a limit on the max amount to redeem and mint in a block. This can be crucial to the users that are minting or redeeming...

A fully blacklisted user can withdraw their funds

Lines of code Vulnerability details Impact A fully blacklisted user should not have access to any function of the protocol, but it is possible for a user to withdraw their funds right before being blacklisted. A fully blocked user is capable of frontrunning the addToBlacklist call by calling the...

bad Actor can block the operation of mint by creating duplicate order by frunt runing original order

Lines of code Vulnerability details Impact bad Actor can block the operation of mint by creating duplicate order by frunt runing original order So basically the contracts are doing orders by users RFQ to system whether by API or front end. and make the mint process the problem is in the contract...

Lender can cause unintended behavior for the borrower's transaction

Lines of code Vulnerability details This vulnerability comes in the form of when a borrower wants to remove a lender as a both deposit and withdraw and set them as a withdraw only, to avoid paying more interest on their funds in the market, this plan may not go as planned, based on the nature of...

OFAC sanctioned lender can frontrun nukeFromOrbit with a transfer of his funds

Lines of code Vulnerability details Impact In order to prevent a sanctioned lender for example by OFAC to poison an entire market, a function has been developed to block and transfer the sanctionned user's funds to an escrow contract. This escrow contract can be released if borrower decides so by...