Keeper Security Keeper Password Manager 安全漏洞

Keeper Security Keeper Password Manager is a password management system from Keeper Security. A security vulnerability exists in Keeper Security Keeper Password Manager version 16.10.2, which originates from a vulnerability that allows a local attacker to gain access to sensitive information via...

CVE-2023-36266

Keeper Password Manager for Desktop (v16.10.2) and KeeperFill Browser Extensions (v16.5.4) store credentials in plaintext in memory after login, enabling local attackers to access sensitive data and potentially persist after logout. The issue is addressed in Keeper v17.2. Root cause: plaintext in...

PT-2023-25503 · Keeper · Keeper Password Manager For Desktop +1

Name of the Vulnerable Software and Affected Versions: Keeper Password Manager for Desktop version 16.10.2 KeeperFill Browser Extensions version 16.5.4 Description: An issue allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already...

Keepers are allowed to use the full EUSD balance of any provider to liquidate funds

Lines of code Vulnerability details Impact Keepers are allowed to use the full EUSD balance of any provider to liquidate funds. Normally, the keeper should only be allowed to use max of the amount that the provider approves to LybraStETHVault. But the check only checks if the provider gives an...

Doesn’t have proper slippage control.

Lines of code Vulnerability details Impact For risk management purposes, a swap will fail if the input coin amount exceeds a predefined limit. But it is not a slippage control. It doesn’t consider how many Canto a user wants to swap for. It is possible that the user will swap the token at a very...

CVE-2023-25793

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in George Pattihis Link Juice Keeper plugin = 2.0.2 versions...

CVE-2023-25793

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in George Pattihis Link Juice Keeper plugin = 2.0.2 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in George Pattihis Link Juice Keeper plugin = 2.0.2 versions...

CVE-2023-25793

CVE-2023-25793 describes a stored XSS vulnerability in the WordPress plugin Link Juice Keeper, affecting versions

CVE-2023-25793 WordPress Link Juice Keeper Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in George Pattihis Link Juice Keeper plugin = 2.0.2 versions...

PT-2023-20308 · Unknown · Link Juice Keeper

Name of the Vulnerable Software and Affected Versions: Link Juice Keeper plugin versions prior to 2.0.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 2.0.3,...

WordPress plugin Link Juice Keeper 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

SUSE CVE-2012-0421

The SUSE Audit Log Keeper daemon before 0.2.1-0.4.6.1 for SUSE Manager and Spacewalk uses world-readable permissions for /etc/auditlog-keeper.conf, which allows local users to obtain passwords by reading this file...

WordPress Link Juice Keeper Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Link Juice Keeper Type Plugin Vulnerable versions = 2.0.2 Fixed in 2.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25793 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e876a8c5d0a6 Credits Abdi Pranata Required...

Link Juice Keeper < 2.0.3 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Incorrect fee distribution due to reorg

Lines of code Vulnerability details Impact In the PostTxProcessing hook, new events are processed immediately and the addresstokenid mapping is registered to the keeper. The keeper throw an error upon duplicated registration. When there is a chain reorg that changed the registration on the EVM...

Malicious Package

Overview starknet-dai-keeper is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...

possibility of front-run on swap()

Lines of code Vulnerability details Impact The user swapper could lose all their money Proof of Concept 1- the user invokes swap with tokenIn == ohm 2- on this line MINTR.burnOhmaddressthis, amountIn; this user send their money to the TRSRY.sol 3- keeper invoke beat to update the price 4- here...

getLastPrice() return wrong price

Lines of code Vulnerability details Impact operate and addObservation both of them use PRICE.getLastPrice but it will return wrong price. So all the updates are just random prices Proof of Concept 1- keeper invoke beat on Heart.sol 2- this operator.operate; to trigger price range update and marke...

Wrong keeper reward computation

Handle cmichel Vulnerability details The PoolKeeper.keeperReward computation mixes WADs and Quads which leads to issues. 1. Note that keeperTip returns values where 1 = 1%, and 100 = 100%, the same way BASETIP = 5 = 5%. Thus tipPercent = ABDKMathQuad.fromUIntkeeperTip is a Quad value of this keep...