PerpetualAtlanticVaultLP incentives can be stolen via flash loan

Lines of code Vulnerability details Impact The liquidity pooled from the PerpetualAtlanticVaultLP is used by the core contract. This liquidity is provided by anyone, and after each epoch 1 week an incentive is paid after to further incentivise liquidity provision. However, the funds can be stolen...

Failed payment recorded has completed in Silverstripe Omnipay

Impact For a subset of Omnipay gateways those that use intermediary states like isNotification or isRedirect, if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as completed without payment being taken. This is mitigated by the fact that most...

CVE-2022-29254 Failed payment recorded has completed in silverstripe/silverstripe-omnipay

silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways those that use intermediary states like isNotification or isRedirect, if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as...

CVE-2022-26273

EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities...

The vulnerability of Google Chrome’s online payment mechanism, which allows a violator to compromise data integrity

The vulnerability of Google Chrome’s online payment mechanism is related to the lack of a standard permission mechanism. Exploiting this vulnerability allows a malicious actor to affect data integrity through a specially created HTML page...

Payment Logic Vulnerability in Cloud Industry CMS ca***.php File

Yunye CMS is an enterprise website building system developed by Luoyang Yunye Information Technology Co. Payment logic vulnerability exists in the CMS ca.php file. Attackers can use this vulnerability to arbitrarily modify the size of the payment amount...

Payment Design Vulnerability in the Frontend of Rice CMS

DAMI CMS is a PC building station and cell phone building station integrated all-in-one system. A payment design vulnerability exists in the frontend of Daimi CMS. An attacker can utilize this vulnerability to arbitrarily modify the size of the payment amount...

EZZY APP Android version of the deposit function module has a payment design loophole

EZZY APP is a car intelligent sharing platform APP created by Beijing Daimeng Technology Co. The Android version of EZZY APP has a vulnerability in the amount payment design. After logging into the system, an attacker can arbitrarily modify the size of the payment amount by clicking on the paymen...

vc movie app has a payment logic design flaw

vc movie app is a movie information software on the phone. The vc movie app has a payment logic design vulnerability. Attackers use the vulnerability to bypass the payment verification mechanism to modify the payment amount...

Xi'an Concert Hall App Payment Logic Vulnerability

Xi'an Concert Hall Android Client is a smartphone application that provides Xi'an Concert Hall performance inquiry and ticket purchase. A payment logic vulnerability exists in the Xi'an Concert Hall app. An attacker can modify the payment amount by bypassing the bank verification mechanism by...

OOracle Retail Applications Unspecified Vulnerability in Oracle Retail Xstore Payment

Oracle Retail Applications is the United States Oracle Oracle company's set of retail applications store solutions. Oracle Retail Xstore Payment is one of the retail service payment pieces. A local security vulnerability exists in the Security subcomponent of the Oracle Retail Xstore Payment...

jewishfairlawn.org XSS vulnerability

Vulnerable URL: http://www.jewishfairlawn.org/payment.php?notes=%3C/stYle/%3C/titLe/%3C/teXtarEa/%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 25.06.2016 Latest check for patch:| 25.06.2016 11:36 GMT Vulnerability type:| XSS Vulnerability...

bayt.ca XSS vulnerability

Vulnerable URL: http://www.bayt.ca/payment.php?notes=%3C/stYle/%3C/titLe/%3C/teXtarEa/%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2996612 VIP website status:...

bethelbinah.org XSS vulnerability

Vulnerable URL: http://www.bethelbinah.org/payment.php?notes=%3C/stYle/%3C/titLe/%3C/teXtarEa/%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 20095482 VIP websit...

PHPOK企业建站系统(支付漏洞1元任意买);

简要描述： PHPOK企业建站系统PHPOK4.4.010支付漏洞1元任意买最新版 详细说明： 1.来到产品展示随便选入一件商品进购物车下订单 2.来到之类点确认支付抓包修改金额 3.改成1元然会出现链接点开就好了 只要1元就可以 漏洞证明： 1.来到产品展示随便选入一件商品进购物车下订单 img src="https://images.seebug.org/upload/201511/0919554096547d3a4eb6da54be5276c7ad0c1967.jpg" a...

CVE-2013-4594

The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment...

phpyun设计缺陷可用别的账户money付款，清空别的账户money为0

简要描述： 后台在处理订单的时候，直接获取cookie中的uid，此uid可以伪造成他人的uid，导致可用他人的money付款。 经过测试，虽然自己并不能获得支付成功的积分，但是可以扣除他人账户余额。 详细说明： 漏洞文件\api\tenpay\index.php: $sql=$db-query"select from ".$dbconfig"def"."companyorder where orderid='$POSTdingdan'"; $row=mysqlfetcharray$sql; //通过订单编号获取点单价格 $userid=int$COOKIE'uid';...