CVE-2022-0421

The Five Star Restaurant Reservations WordPress plugin prior to version 2.4.12 has an authorization flaw that allows unauthenticated users to change the payment status of arbitrary bookings. The issue is exacerbated by insufficient sanitization/escaping, enabling stored XSS against administrators...

Design/Logic Flaw

Lightning Network Daemon lnd is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version v0.15.4 are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments a...

calling execute() may lead to stealing funds if some ETH is stuck on the contract

Lines of code Vulnerability details Impact if some Ether is sent erroneously or not to the contract, anyone that calls correctly LooksRareAggregator.execute will be able to steal those coins. to execute the function using ethers as payment, these conditions must be true: there is at least a trade...

CVE-2022-2387

The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack...

CVE-2022-2387

The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack...

Cross site request forgery (csrf)

The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack...

WordPress plugin Easy Digital Downloads 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site request forgery vulnerability exists in the...

PT-2022-16302 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads WordPress plugin versions prior to 3.0 Description: The issue arises from the lack of a CSRF check when deleting payment history, and the failure to verify that the post to be deleted is actually a payment history. This...

Police warn of fake law enforcement arrest warrant calls

Brownsville Police Department is warning about scammers impersonating law enforcement in order to extract money from potential victims. The scam involves pressure from an immediate threat, several ways to extract yourself from this non-existent claim of wrongdoing, and multiple levels of...

WordPress Five Star Restaurant Reservations plugin <= 2.4.11 - Unauth. Arbitrary Payment Status Update leading to Stored Cross-Site Scripting (XSS) vulnerability

Unauth. Arbitrary Payment Status Update leading to Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Five Star Restaurant Reservations plugin versions = 2.4.11. Solution Update the WordPress Five Star Restaurant Reservations plugin to the latest available...

Pledge creator can extend pledge without paying in edge cases.

Lines of code Vulnerability details Impact Pledge creator can extend pledge without paying in edge cases. Proof of Concept When pledge creators wants to extend their pledges, they must transfer an additional reward amount and fee: uint256 totalRewardAmount = pledgeParams.rewardPerVote...

Liquidatin function does not consider cases where the liquidate user does not have enough collateral to pay.

Lines of code Vulnerability details Impact Liquidatin function does not consider cases where the liquidate user does not have enough collateral to pay. Proof of Concept The problem is the paid collateral in determined by repaiddebt: I ingnored decimals for simplifcation of the formulas I'm gonna...

13 Cybersecurity Horror Stories to Give you Sleepless Nights

Are we sitting comfortably? Twas a dark and stormy night, and the cybersecurity team stood patiently in their Scrum meeting. “Tell us a tale,” the CISO said, and one of their number raised their hand. They caught the eye of their colleagues, and began… 1. An artists tale Curious reader, gird thy...

Point-of-sale malware used to steal 167,000 credit cards

In the 19 months between February 2021 and September 2022, two point-of-sale POS malware operators have stolen more than 167,000 payment records, mainly from the US, according to researchers at Group-IB. The researchers were able to retrieve information about infected machines and compromised...

DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector

In recent months, Microsoft has detected active ransomware and extortion campaigns impacting the global education sector, particularly in the US, by a threat actor we track as DEV-0832, also known as Vice Society. Shifting ransomware payloads over time from BlackCat, QuantumLocker, and Zeppelin,...

Cybercriminals Used Two PoS Malware to Steal Details of Over 167,000 Credit Cards

Two point-of-sale PoS malware variants have been put to use by a threat actor to steal information related to more than 167,000 credit cards from payment terminals. According to Singapore-headquartered cybersecurity company Group-IB, the stolen data dumps could net the operators as much as $3.34...

NFT not minted when contributed via a supported payment terminal

Lines of code Vulnerability details Impact A contributor won't get an NFT they're eligible for if the payment is made through a payment terminal that's supported by the project but not by the NFT delegate. Proof of Concept A Juicebox project can use multiple payment terminals to receive...

didPay() receives payment but does not mint NFT to beneficiary as expected.

Lines of code Vulnerability details Impact The function JB721Delegate.didPay is expected to mint an NFT to the beneficiary if conditions are met. However the function only receives payment through payable, but does nothing else in the processPayment call if function does not revert. The expected...

Owner can set contribution floor to 0 , meaning the user lose the fund / fee for 0 contribution power NFT and NFT have no redemption weight

Lines of code Vulnerability details Impact Owner can set contribution floor to 0, meaning the user lose the fund / fee for 0 contribution power NFT and NFT have no redemption weight. the normal payment flow for user is Payment Terminal - pay - didPay - processPayment - // Mint rewards if they wer...

Man scammed IRL for a phone he sold online

If youre looking to sell an item which youve advertised online, be on your guard. Even when everything looks to be working as it should, things can go wrong very quickly as one unfortunate IT graduate recently discovered. You would think that theres no way the in-person sale of an expensive devic...