PT-2023-14727 · Sleuth Kit · Sleuthkit

Name of the Vulnerable Software and Affected Versions: sleuthkit fls tool version 4.11.1 Description: The issue allows attackers to execute arbitrary commands via a crafted value to the m parameter. This is an OS Command injection vulnerability. Note that there is a dispute regarding the impact o...

CVE-2022-45639: Improper Neutralization of Special Elements used in an OS Command

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user...

Upgraded Q -> M from #50 [1674461707004]

Judge has assessed an item in Issue 50 as M risk. The relevant finding follows: QA10. The deposit function only works for tokens that have no more than 18 decimals. This needs to be documented. --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> M from #351 [1674418158719]

Judge has assessed an item in Issue 351 as M risk. The relevant finding follows: Stable Vault cannot accept tokens with more then 18 decimals because of this lines: Consider using different conversion formula. For example: amount 1e18 / 10token.decimals for deposit and amount 10token.decimals /...

Upgraded Q -> M from #164 [1674419095024]

Judge has assessed an item in Issue 164 as M risk. The relevant finding follows: LOW‑1 The Contract Should approve0 First Some tokens like USDT L199 do not work when changing the allowance from an existing non-zero allowance value. They must first be approved by zero and then the actual allowance...

Upgraded Q -> M from #97 [1674422838137]

Judge has assessed an item in Issue 97 as M risk. The relevant finding follows: DOS StableVault deposit and withdraws if ERC20 with more than 18 decimals used. Description withdraw and deposit functions in StableVault will revert if ERC20 token with more than 18 decimals is used. This is due to a...

Upgraded Q -> M from #445 [1674423223201]

Judge has assessed an item in Issue 445 as M risk. The relevant finding follows: 5 Function crossChain in GovNFT should have limit for maximum tokens allowed to be transferred, because of gas limit in the dest chain. if a user transferred a lot of tokens because there was two loop inside each oth...

Upgraded Q -> M from #658 [1674423084300]

Judge has assessed an item in Issue 658 as M risk. The relevant finding follows: L-04 USDT IS NOT SUPPORTED FOR CALLING Trading.handleDeposit FUNCTION ON ETHEREUM MAINNET As shown by , USDT on the Ethereum mainnet does not allow approving a new amount when the existing approved amount is not zero...

WordPress M Chart Plugin <= 1.9.4 is vulnerable to Cross Site Scripting (XSS)

Software M Chart Type Plugin Vulnerable versions = 1.9.4 Fixed in 1.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23892 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 383eb1775479 Credits thiennv Required privilege...

CVE-2023-22278

m-FILTER prior to Ver.5.70R01 Ver.5 Series and m-FILTER prior to Ver.4.87R04 Ver.4 Series allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent under the certain conditions. The attacks exploiting this vulnerability have been...

CVE-2023-22278

m-FILTER prior to Ver.5.70R01 Ver.5 Series and m-FILTER prior to Ver.4.87R04 Ver.4 Series allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent under the certain conditions. The attacks exploiting this vulnerability have been...

Authentication flaw

m-FILTER prior to Ver.5.70R01 Ver.5 Series and m-FILTER prior to Ver.4.87R04 Ver.4 Series allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent under the certain conditions. The attacks exploiting this vulnerability have been...

CVE-2023-22278

The email security product m-FILTER by Digital Arts Inc. contains an improper authentication vulnerability (CWE-287). Under certain conditions, a remote unauthenticated attacker can bypass authentication to send unintended emails. Reported impacts include the blacklisting of the source IP address...

PT-2023-18391 · M-Filter · M-Filter

Name of the Vulnerable Software and Affected Versions: m-FILTER versions prior to 5.70R01 Ver.5 Series m-FILTER versions prior to 4.87R04 Ver.4 Series Description: The issue allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent...

CVE-2023-22278: Improper Authentication

m-FILTER prior to Ver.5.70R01 Ver.5 Series and m-FILTER prior to Ver.4.87R04 Ver.4 Series allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent under the certain conditions. The attacks exploiting this vulnerability have been...

CVE-2023-22278

m-FILTER prior to Ver.5.70R01 Ver.5 Series and m-FILTER prior to Ver.4.87R04 Ver.4 Series allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent under the certain conditions. The attacks exploiting this vulnerability have been...

CVE-2023-22278

m-FILTER prior to Ver.5.70R01 Ver.5 Series and m-FILTER prior to Ver.4.87R04 Ver.4 Series allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent under the certain conditions. The attacks exploiting this vulnerability have been...

Upgraded Q -> M from #216 [1673172689834]

Judge has assessed an item in Issue 216 as M risk. The relevant finding follows: Last collateral check is not safe --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> M from #173 [1673098404536]

Judge has assessed an item in Issue 173 as M risk. The relevant finding follows: L-03 - Depreciating-soon selfdestruct is used to transfer funds to seller after sale ends. --- The text was updated successfully, but these errors were encountered: All reactions...

Digital Arts m-FILTER vulnerable to improper authentication

Overview m-FILTER provided by Digital Arts Inc. is an emaill security product. m-FILTER contains an improper authentication vulnerability CWE-287 when emails are being sent under certain conditions, and unintended emails may be sent by a remote attacker. Digital Arts Inc. states that attacks...