44 matches found
laravel-crypto-killer
Laravel crypto killer Ein Werkzeug, das entwickelt wurde, um schlechte Implementierungen von EntschlĆ¼sselungsmechanismen in Laravel-Anwendungen auszunutzen. Dieses Werkzeug wurde ursprĆ¼nglich entwickelt, um Payloads zu erstellen, die die Laravel-decrypt-Funktion aus dem Paket Illuminate\Encryptio...
CLSA-2026-1770598645 TuxCare security update for illuminate/view (1 CVE)
TuxCare rebuilt illuminate/view to address 1 CVE. Fixed in 5.4.36-p1+tuxcare...
CLSA-2026-1772239984 TuxCare security update for illuminate/database (1 CVE)
TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p1+tuxcare...
CLSA-2026-1772326385 TuxCare security update for illuminate/database (1 CVE)
TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p2+tuxcare...
PT-2026-73741
TuxCare rebuilt illuminate/view to address 1 CVE. Fixed in 5.4.36-p1+tuxcare...
PT-2026-73805
TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p2+tuxcare...
PT-2026-73803
TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p1+tuxcare...
EUVD-2021-0484
Malware in sbrugna...
CVE-2021-21263
Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an...
BIT-LARAVEL-2021-21263 Query Binding Exploitation in Laravel
Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an...
CVE-2023-29931
laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php...
CVE-2023-29931
laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php...
CVE-2022-40482: Observable Discrepancy
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...
CVE-2022-40482
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...
CVE-2022-40482
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...
Illuminate PT redeeming do not return underlying to a user
Lines of code Vulnerability details In the second step of two step redeeming process, the underlying funds should be located in the Redeemer contract as external system burned the shares the Redeemer obtained from the Lender contract and returned underlying to Redeemer. Then Redeemer's Illuminate...
Illuminate PT redeeming allows for burning from other accounts
Lines of code Vulnerability details Illuminate PT burns shares from a user supplied address account instead of user's account. With such a discrepancy a malicious user can burn all other's user shares by having the necessary shares on her balance, while burning them from everyone else. Setting th...
[H-05] Not minting iPTs for lenders in several lend functions
Lines of code Vulnerability details Impact Using any of the lend function mentioned, will result in loss of funds to the lender - as the funds are transferred from them but no iPTs are sent back to them! Basically making lending via these external PTs unusable. Proof of Concept There is no mintin...
Sense AMM address can be manipulated, allowing unlimited mint of principal tokens
Lines of code Vulnerability details Lender's lend for Sense uses ISensex.swapUnderlyingForPTs output to determine the Illuminate PT amount to be minted for the user. x is a user supplied and not verified address, which can be precooked by a malicious user to return any inflated amount, that will ...
No minting done in the Element version of lend function, user funds are frozen within the system
Lines of code Vulnerability details Lender's Element lend transfers the funds from a user, opens the position with Element, but fails to mint a corresponding Illuminate position to a user. Setting severity to be high as there is no account of user investment is effectively created, so there is no...