Incorrect Stability Assumption

Handle 0xsomeone Vulnerability details Impact An arbitrage opportunity presents itself whereby a user can exaggerate the discrepancy via flash loans between the USDC price reported and the actual USDC price to f.e. acquire a better rate for their loan. The impacted features of the system can be...

Loans of tokens with >18 decimals can result in incorrect collateral calculation

Handle 0xsomeone Vulnerability details Impact It is possible for a user to mislead a Pool Delegate to a seemingly innocuous loan by utilizing a token with more than 18 decimals as collateral and lucrative loan terms. Proof of Concept The final calculation within the collateralRequiredForDrawdown ...

The First User To Borrow a Particular Token Can Drain Funds In MarginSwap by Making An Undercollateralized Borrow Using Flash Loans

Handle jvaqa Vulnerability details The First User To Borrow a Particular Token Can Drain Funds In MarginSwap by Making An Undercollateralized Borrow Using Flash Loans Impact This attack can be performed with any two ERC20 tokens, where one of them has not yet been borrowed on MarginSwap. Since an...

Hacked Data Broker Accounts Fueled Phony COVID Loans, Unemployment Claims

A group of thieves thought to be responsible for collecting millions in fraudulent small business loans and unemployment insurance benefits from COVID-19 economic relief efforts gathered personal data on people and businesses they were impersonating by leveraging several compromised accounts at a...

Social Engineering Based on Stimulus Bill and COVID-19 Financial Compensation Schemes Expected to Grow in Coming Weeks

Given the community interest and media coverage surrounding the economic stimulus bill currently being considered by the United States House of Representatives, we anticipate attackers will increasingly leverage lures tailored to the new stimulus bill and related recovery efforts such as stimulus...

Auto Lender Exposes Loan Data For Up To 1 Million Applicants

A California auto loan company left the names, addresses, credit scores and partial Social Security numbers of up to 1 million people exposed on an insecure online database. The company behind the database is Alliance Direct Lending Corporation, according to Kromtech Security Research Center, whi...

yachtworld.com XSS vulnerability

Vulnerable URL: https://www.yachtworld.com/boat-loans/index.jsp?sm=alert'OPENBUGBOUNTY';...

Кредиты и микро-займы онлайн - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Кредиты и микро-займы онлайн published at the 'play' market has multiple vulnerabilities...

myiris.com XSS vulnerability

Vulnerable URL: http://www.myiris.com/loans/auto/carBank.php?carname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 180639 Google...

CVE-2014-6765

The No Fuss Home Loans aka com.soln.SA2CAA74BBC3AFEFE7C8BE3F3AAC499E7 application 1.0035.b0035 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The No Fuss Home Loans aka com.soln.SA2CAA74BBC3AFEFE7C8BE3F3AAC499E7 application 1.0035.b0035 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6765

The CVE-2014-6765 entry concerns the Android app No Fuss Home Loans (com.soln.SA2CAA74BBC3AFEFE7C8BE3F3AAC499E7) version 1.0035.b0035, which does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted cert...

CVE-2014-6765

The No Fuss Home Loans aka com.soln.SA2CAA74BBC3AFEFE7C8BE3F3AAC499E7 application 1.0035.b0035 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PMB Services <= 3.4.3 SQL Injection Vunerability

Exploit for php platform in category web applications ---------------------------------------------------------------------------- Exploit Title: PMB Services = 3.4.3 Remote SQL Injection Author : Luchador Date : 29-01-2011 Location : Algeria Site : http://vbspiders.com Critical Lvl : Dangerous...

Beware Of Phishing Scams, Vishing, And Other Smishing !

Better Business Bureau has published a list of top 10 scam that seems not only to the biggest scam in 2010, but what to watch in 2011. In no particular order, here they are: Door to door scams Each of the new season of the show to attract new scammer port provides an incredible offer: Roofing in...

PMB Services 3.0.13 - Multiple Remote File Inclusions

PMB Services 3.0.13 - Multiple Remote File Inclusions \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV68$2007 ----------------------------------------------------------------------------------------- ECHOADV68$2007 PMB Services = 3.0.13 Multiple Remote File...

PMB Services 3.0.13 - Multiple Remote File Inclusions

\ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV68$2007 ----------------------------------------------------------------------------------------- ECHOADV68$2007 PMB Services = 3.0.13 Multiple Remote File Inclusion Vulnerability...

CVE-2002-1020

The library feature for Adobe Content Server 3.0 allows a remote attacker to check out an eBook even when the maximum number of loans is exceeded by accessing the "Add to bookbag" feature when the server reports that no more copies are available...

CVE-2002-1020

The CVE-2002-1020 entry concerns Adobe Content Server 3.0. The vulnerability arises in the library feature used for the Add to bookbag operation: when the server reports that no more copies are available, a remote attacker can still check out an eBook. This implies an underlying logic flaw where ...