CVE-2023-0527: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file search-request.php. The manipulation of the argument searchdata with the input " leads to cross site scripting. The atta...

PHPGurukul Online Security Guards Hiring System 跨站脚本漏洞

Online Security Guards Hiring System is an online security guard hiring system. A cross-site scripting vulnerability exists in version 1.0 of the PHPGurukul Online Security Guards Hiring System, which stems from an incorrect manipulation of the parameter searchdata that can lead to cross-site...

Some Meta Employees and Security Guards Hacked User Accounts

By Deeba Ahmed The fired individuals included on-contract security guards who worked for Meta and could access an internal tool for employees. This is a post from HackRead.com Read the original post: Some Meta Employees and Security Guards Hacked User Accounts...

Museum Security

Interesting interview: Banks dont take millions of dollars and put them in plastic bags and hang them on the wall so everybody can walk right up to them. But we do basically the same thing in museums and hang the assets right out on the wall. So its our job, then, to either use technology or...

Re-entrancy in wfCashERC4626.redeem() can lead to more gains in assets and/or shares

Lines of code Vulnerability details Impact The redeem function in wfCashERC4626.sol can be re-entered at the point of redeemInternal. Assume underlying tokens are sent to receiver after shares are burnt, and user re-enters redeem after redeemInternal is completed., P.S: there's a separate issue o...

Re-entrancy in wfCashERC4626.withdraw() can lead to more gains in assets

Lines of code Vulnerability details This is a corrected version of the previous submission and typo mistakes corrected. Impact The withdraw function in wfCashERC4626.sol can be re-entered at the point of redeemInternal. Assume asset tokens are sent to receiver after shares are burnt, and user...

Loss of tokens due to wrong burn function

Lines of code Vulnerability details Impact The redeem function calls burn which is inherited from IERC777Upgradeable contract whose action is to burn ERC20 tokens, thus there is no transfer or withdrawal of asset tokens to a receiver. The redeemToAsset is also affected by this since it calls...

Loss of tokens due to wrong burn function

Lines of code Vulnerability details Impact redeemToUnderlying is also affected by the issue I reported earlier which is described below. The redeem function calls burn which is inherited from IERC777Upgradeable contract whose action is to burn ERC20 tokens, thus there is no transfer or withdrawal...

CVE-2021-32009 Missing XSS guards on firmware page

Cross-site Scripting XSS vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser session. This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions...

No reentrancy guards on functions using .call

Handle jayjonah8 Vulnerability details Impact In BridgeMinter.sol the migrateToNewMinter and withdrawETHToL1Migrator both use the .call function without adding reentrancy guard modifiers to the functions. This is important when using .call as functions can be reentered before execution is complet...

Reentrancy vulnerability allows attacker to gain more shares than deserved

Handle harleythedog Vulnerability details Impact In Vault.sol, the deposit function is the external function that allows transferring underlying tokens to mint position NFTs. The deposit function first calls createDeposit which creates the position/determines how many shares to allocate, and then...

Reentrancy vulnerability allows attacker to steal underlying tokens with withdraw

Handle harleythedog Vulnerability details Impact The withdrawDeposit function has the following code which runs before the underlying tokens are transferred to the to address: if isIntegrationclaim.beneficiary bytes4 ret = IIntegrationclaim.beneficiary.onDepositMinted tokenId, newShares, claim.da...

Gerdab.ir SQL Injection

This site belongs to the Revolutionary Guards Intelligence Organization of the Islamic Republic of Iran IRGC, which has a security problem with the SQL INJECTION Vulnerability "CWE-89". We have repeatedly reported to this site that it has a security problem and has ignored our report. We want to...

Some lock_api lock guard objects can cause data races

Affected versions of lockapi had unsound implementations of the Send or Sync traits for some guard objects, namely: MappedMutexGuard MappedRwLockReadGuard MappedRwLockWriteGuard RwLockReadGuard RwLockWriteGuard These guards could allow data races through types that are not safe to Send across...

RUSTSEC-2020-0070 Some lock_api lock guard objects can cause data races

Affected versions of lockapi had unsound implementations of the Send or Sync traits for some guard objects, namely: MappedMutexGuard MappedRwLockReadGuard MappedRwLockWriteGuard RwLockReadGuard RwLockWriteGuard These guards could allow data races through types that are not safe to Send across...

Alert Windows RDP remote vulnerability POC propagation-vulnerability warning-the black bar safety net

! 0x00 description 2019 5 August 31, 360 is detected on github someone posted a lead to a remote denial of Service POC codehttps://github.com/n1xbyte/CVE-2019-0708and for windows server 2008 R2 x64 demo video, the proven POC code real and effective. An attacker can use to spread the code of the...

Remote Code Execution (RCE)

Microsoft.ChakraCore is vulnerable to remote code execution RCE attacks. The vulnerability exists due to the lack of array guards used in the asmjs on x86, allowing RCE attacks...

CVE–2017–8543 Windows Search remote code execution vulnerability alerts-a vulnerability alert-the black bar safety net

Recently, 360CERT confirm the number CVE-2017-8543 Microsoft Windows Search serious vulnerability there is a remote attack the viability of the vulnerability being successfully exploited on Windows users have a serious security threat, this is again warning the use of Windows platform users...

Iranians Indicted Over DDoS Campaign on Banks, Dam Hack

The U.S. government on Thursday indicted seven hackers affiliated with the Iranian government for attacks it called “a frightening new frontier in cybercrime.” Accusing the men of carrying out a series of distributed denial of service DDoS attacks against 46 financial companies, the Department of...

APPLE-SA-2015-04-08-5 Xcode 6.3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2015-04-08-5 Xcode 6.3 Xcode 6.3 is now available and addresses the following: Clang Available for: OS X Mavericks v10.9.4 or later Impact: An attacker may be able to bypass stack guards Description: A register allocation issue existed in...