104 matches found
CVE-2022-47848
An issue was discovered in Bezeq Vtech NB403-IL version BZ2.02.07.09.13.01 and Vtech IAD604-IL versions BZ2.02.07.09.13.01, BZ2.02.07.09.13T, and BZ2.02.07.09.09T, allows remote attackers to gain sensitive information via rootDesc.xml page of the UPnP service...
CVE-2022-47848
The CVE-2022-47848 issue affects Bezeq Vtech NB403-IL (BZ_2.02.07.09.13.01) and Vtech IAD604-IL (BZ_2.02.07.09.13.01, 13T, 09T). Description: remote attackers can obtain sensitive information via the UPnP service’s rootDesc.xml page, indicating an information disclosure via UPnP. Root cause: expo...
Malicious code in il-shopify-osm-types (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59867423ea3b374a7842d8ca92f05a9b685f8c826bc45939ba1af80f2d088661 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Code injection
In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...
CVE-2022-44310
In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...
CVE-2022-44310
CVE-2022-44310 affects the ecdh.js Node.js native module by Development IL, prior to version 0.2.0. The vulnerability arises when an attacker supplies a public key point that is not on the curve, allowing them to derive the shared secret due to improper validation of the point. This can lead to e...
CVE-2022-44310
In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...
CVE-2022-44310
In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...
部分Bezeq Vtech产品 授权问题漏洞
The Bezeq Vtech NB403-IL is a router from Bezeq. A security vulnerability exists in the Bezeq Vtech NB403-IL version BZ2.02.07.09.13.01, Vtech IAD604-IL version BZ2.02.07.09.13.01, version BZ2.02.07.09.13T, and version BZ2.02.07.09.09T. An attacker can exploit the vulnerability to obtain sensitiv...
il-conto.de Improper Access Control vulnerability OBB-2395658
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Covering impermanent loss allows profiting from asymmetric liquidity provision at the expense of reserves
Handle hyh Vulnerability details Impact Pool funds will be siphoned out over time as swaps and asymmetric LP provision are generally balancing each other economically. While with introduction of IL reimbursement a malicious user can make an asymmetric LP, then profit immediately from out of balan...
Reserve does not properly apply prices of VADER and USDV tokens
Handle TomFrenchBlockchain Vulnerability details Impact Reserve pays out vastly higher or lower IL protection than it should Proof of Concept Consider the lines 98 and 102 as shown on the link below: Here we multiply the IL experienced by the LP by a price for USDV or VADER as returned by the LBT...
Potential economic attack that exploits IL coverage
Handle WatchPug Vulnerability details The current implementation of Vader protocol provides impermanent loss coverage calculated as below: function calculateLoss uint256 originalVader, uint256 originalAsset, uint256 releasedVader, uint256 releasedAsset public pure returns uint256 loss // // TODO:...
Attacker can claim more IL by manipulating pool price then removeLiquidity
Handle gzeon Vulnerability details Impact Vader reimburse user IL immediately when user withdraw from the pool VaderRouterV2.sol:L227, an attacker can therefore manipulate the pool balance causing a high IL, remove liquidity and restore the pool balance such that he will receive a larger IL...
User may not receive the full amount of IL compensation
Handle jonah1005 Vulnerability details Impact The user would not get full IL compensation if there's not enough funds in the reserve. VaderReserve.solL76-L91 VaderReserve.solL85 uint256 actualAmount = minreserve, amount; While this is reasonable, users should be able to specify the minimum receiv...
agenziaimmobiliareilborgo.it Cross Site Scripting vulnerability OBB-2143213
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
schneider.co.il Cross Site Scripting vulnerability OBB-2131587
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2021-33540
In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists...
CVE-2021-33540
The CVE affects Phoenix Contact AXL F BK and IL BK devices, where an undocumented password-protected FTP access to the root directory exists. The root cause is an insecure/undocumented FTP auth path, enabling access to the device’s root filesystem. The available data indicate a high-severity impa...
Phoenix Contact AXL F BK and IL BK 信任管理问题漏洞
Phoenix Contact AXL F BK PN is a bus coupler from Phoenix Contact, Germany. A security vulnerability exists in the Phoenix Contact AXL F BK and IL BK that stems from the program having undocumented password-protected FTP access to the root directory...