CVE-2023-34577

SQL injection vulnerability in Prestashop opartplannedpopup 1.4.11 and earlier allows remote attackers to run arbitrary SQL commands via OpartPlannedPopupModuleFrontController::prepareHook method...

Contao Cross-Site Scripting Vulnerability

Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management, and CSS frameworks. A security vulnerability exists in version 3.x prior to Contao version 3.5.32, which originates from a cross-site scripting attack via the...

CVE-2023-34575

SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCartDefaultModuleFrontController::initContent and OpartSaveCartDefaultModuleFrontController::displayAjaxSendCartByEmail methods...

PrestaShop SQL Injection Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution offers multiple payment methods, short message alerts, and product image scaling. A security vulnerability exists in PrestaShop opartsavecart 2.0.7 and earlier versions, which originated from...

MAL-2023-8151 Malicious code in telia-front-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 915e7468494f50f3f273a20457aa01b3aec6e0f5cae88024b0db7ec5246c32aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in telia-front-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 915e7468494f50f3f273a20457aa01b3aec6e0f5cae88024b0db7ec5246c32aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8118 Malicious code in subspace-relayer-front-end (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5ba5c7d050a216acda3025b0567509efd95f5e86479d47815a1b37ee74553dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-39641

Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontController::initContent...

CVE-2023-39642

Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display...

Malicious code in tv-front (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8a88b2209a83693fc932980b18e993f063b640485d2ba1553fb258374e9d7d9c The OpenSSF Package Analysis project identified 'tv-front' @ 1.1.0 npm as malicious. It is considered malicious because: - The package...

Active Design psaffiliate SQL Injection Vulnerability

Active Design psaffiliate is an application from Active Design. A security vulnerability exists in Active Design psaffiliate versions prior to v1.9.8, which stems from the component PsaffiliateGetaffiliatesdetailsModuleFrontController::initContent that contains an SQL injection vulnerability...

transferIn() is susceptible to a front-running attack

Lines of code Vulnerability details Impact Another auth caller can exploit the vulnerability by executing front-running transactions using the source address that has just given allowance approval to the contract. This allows the attacker to acquire and increase the destination amount of the...

CreateOffererLib#createOrderHash function can be front-run by attacker and cause user create order failed

Lines of code Vulnerability details Impact Function CreateOffererLibcalculateOrderHashAndId is used to calculate ERC20/ERC721/ERC1155 order hash and delegateTokenId. It create delegateTokenId parameter by calling DelegateTokenStorageHelpersdelegateIdNoRevert function, this function calculate...

No protection against conduit front-running

Lines of code Vulnerability details Impact A malicious conduit could front-run and prevent the transfer Proof of Concept The conduit is trusted to conduct the transferFrom in the resulting order. A malicious conduit could front-run and prevent the transfer. calculateOrderHash: This uses the condu...

Logic flaw vulnerability in LiveGBS of Anhui Green Persimmon Information Technology Co., Ltd (CNVD-2023-72138)

LiveGBS is a national standard GB28181 streaming media service software , can provide to provide user management and Web visualization page management , open source front-end page source code ; to provide device status management , you can real-time view of whether the device is offline and other...

Users are able to front-run settlements to avoid loss

Lines of code Vulnerability details Impact A user is able to front-run the call to settle function in to avoid paying the loss. settle is called by Admin which is a public function, When this functions is called the transaction will appear in the mem pool. A user may then call redeem from LP Vaul...

Front-running attack can occur between when the unbonding lock is created and when the delegator's bonded amount is decreased.

Lines of code Vulnerability details Impact This would allow the delegator to temporarily have more bonded tokens than they should. They could take advantage of this by voting in governance with the increased voting power or withdrawing increased fees Proof of Concept 1. When unbond is called, an...

You can front-run to enrich yourself

Lines of code Vulnerability details Impact An attacker can use flash loan and withdraw significant part of funding intended for collateral providers. Proof of Concept Let's consider code snippet from deposit: requireshares = previewDepositassets != 0, "ZEROSHARES";...

Any call to settle a bond can be reverted by donating 1 WEI to the VaultLP contract

Lines of code Vulnerability details Impact Any settle call can be reverted, thus disallowing the protocol from settling any options and from releasing the locked tokens. Proof of Concept The protocol admin calls settle on an option when its price gets bellow the strike price, at which the option ...

[M-01] Transcoder can front-run slasher to avoid getting slashed and continue voting

Lines of code Vulnerability details Impact In BondingManager.slashTranscoder, verifier can slash transcoderdelegator bonded amounts. However, this can be easily front runned via BondingManager.unbondWithHint by reducing bonded amount to avoid slashing via underflow and keep bonded position...