AMD INVD Instruction Security Notice

Bulletin ID: AMD-SB-3005 Potential Impact: Memory integrity Severity: Medium Summary External researchers reported a potential vulnerability with the INVD instruction that may lead to a loss of SEV-ES and SEV-SNP guest virtual machine VM memory integrity. CVE Details Refer to Glossary for...

Intel® OpenVINO™ Software Advisory

Summary: Potential security vulnerabilities in some Intel® OpenVINO™ software may allow denial of service, information disclosure. Intel is releasing sotfware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2023-25080 Description: Protection mechanism failur...

Intel® Server Board and Server System Firmware Advisory

Summary: Potential security vulnerabilities in some Intel® Server Board and Server System BIOS firmware may allow escalation of privilege. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2023-34431 Description: Improper input...

megplay.com Cross Site Scripting vulnerability OBB-3779233

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

This is a repository containing operational information regarding the vulnerability in the Log4j logging library CVE-2021-44228. The repository includes information on hunting for exploitation, indicators of compromise IoCs, mitigation, and scanning for the Log4j vulnerability. It also contains a...

collection admin can still change delegation Address by calling setCollectionCosts()

Lines of code Vulnerability details Impact Function updateDelegationCollection which update allowlist mint delegation collection prevents collection admin and any other actors from perfoming this except global and Function Admin. However, collection admin can still change delegation Address by...

Missing Reentry Protection in 'emergencyWithdraw' function

Lines of code Vulnerability details Ensure that all state changes in emergencyWithdraw are done before the external call to prevent reentrancy attacks. The function is vulnerable to reentrancy attacks due to the use of .callvalue: balance"". This can be mitigated by adding a reentrancy guard.- Po...

AuctionDemo opens itself several DoS attack vectors

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept The auctionDemo.auctionInfoData map holds important info on auctions, and hold this info per tokenId. Needless to say, for many auctions that may become popular and/or long running, the...

Switching to sales model 3 for a collection with pre-existing supply could brick the ' mint() ' function for that collection.

Lines of code Vulnerability details Impact ' Periodic sales' model cannot be used in a collection with Pre-existing supply because of how timeOfLastMint is calculated in mint function. This prevents the system from flexibly combining different sales models in a single collection as intended by th...

WordPress AWeber Plugin <= 7.3.9 is vulnerable to Broken Access Control

Software AWeber Type Plugin Vulnerable versions = 7.3.9 Fixed in 7.3.10 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-47757 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID e7c43a48f73b Credits Abdi Pranata Required privilege...

Winner of auction status is not set to false after claim so eligible for refund

Lines of code Vulnerability details Impact Bidders funds will get stuck Proof of Concept After Auction winner claims token, his/her status is not set to false so he is eligible for a refund because the refund logic checks for all indexes with status set to true, which not supposed to be so. So th...

NFT Claiming Issue Due to Lacking Ownership

Lines of code Vulnerability details Impact The vulnerability in the AuctionDemo contract has a significant impact on the ability of auction winners to claim their NFTs. The root cause of the vulnerability is that the AuctionDemo contract fails to check whether it owns or has approval to transfer...

When the burnToMint function is enabled, any bad actor can transfer the nft-to-burn when it receives the newly minted nft, getting burned after he no longer is the owner.

Lines of code Vulnerability details Impact Medium impact, it affects the functionallity of the nfts with other contracts, as they wouldn't want to interact with tokens that could get burned. Explanation in the NextGenCore contract, the burnToMint function has the minting of the new nft, which mak...

Cross-Contract Reentrancy can occur during burnToMint

Lines of code Vulnerability details Impact Cross Contract re-entrancy can occur due to not following CEI Proof of Concept 1. Attacker can call burnToMint, with any of the tokenId he owns! 2. This calls the burnToMint in GenCore, which mints the the new token from the to be minted collection...

AuctionDemo::claimAuction() - L105: Logic bug in the conditional statement where the timestamp check should be > instead of >=.

Lines of code Vulnerability details Impact Would enable the winning bidder/bid to be selected WHILE it's still possible to bid higher in the auction. I.e. current comparison logic makes it possible to select auction winner while the auction isnt over yet. there's the risk of the true/valid highes...

Bid's array can be overloaded with dust bids to break AuctionDemo funcionality.

Lines of code Vulnerability details Description Bids to the auction can be created using any msg.value via participateToAuction method and are stored in an array within the mapping auctionInfoData. However, all important methods claimAuction, returnHighestBid, returnHighestBidder,...

WordPress Frontend File Manager Plugin < 22.6 is vulnerable to Arbitrary File Download

Software Frontend File Manager Type Plugin Vulnerable versions 22.6 Fixed in 22.6 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-5105 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID 66e0e4c68ed0 Credits Dmitrii Ignatyev...

Last token of maximum supply can be paid, but it isn't minted nor reverted.

Lines of code Vulnerability details Description collectionCirculationSupply is incremented in each mint and it's used to check if the mint don't overtakes the collection's max supply. However, it increments before the check, which makes that although last token is in the max supply range, the...

Contract can be drained from the claimAuction contract

Lines of code Vulnerability details Impact Due to the way the claimAuction function is written, it is also possible to drain the contract when sending bids back to users. This can only happen if the highestBidder made multiple bids which is likely. Proof of Concept In this section of the...

AuctionDemo::claimAuction() - L105: Logic bug in the conditional statement where the timestamp check should be > instead of >=.

Lines of code Vulnerability details Impact Would enable the winning bidder/bid to be selected WHILE it's still possible to bid higher in the auction. I.e. current comparison logic makes it possible to select auction winner while the auction isnt over yet. there's the risk of the true/valid highes...