Zibal 安全漏洞

Zibal is the Zibal payment gateway. A security vulnerability exists in Zibal. An attacker could exploit the vulnerability to access sensitive user information and digital currency keys, as well as elevated privileges...

MAL-2022-7374 Malicious code in zalopay-payment-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f2446418ad41cf8aea6d5900977109ccc23b832966a0c1d481fadf1e6f63720 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zalopay-payment-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f2446418ad41cf8aea6d5900977109ccc23b832966a0c1d481fadf1e6f63720 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in guest-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ce1cff0935b74e6c78fb7c631345ff63909f30095a79fe559ae55d0182e8c35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3495 Malicious code in guest-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ce1cff0935b74e6c78fb7c631345ff63909f30095a79fe559ae55d0182e8c35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dazaar-payment-lightning (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7226941fe2ffff561836755d642ba46fd05042203afb41780113b47705fd0062 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2358 Malicious code in dazaar-payment-lightning (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7226941fe2ffff561836755d642ba46fd05042203afb41780113b47705fd0062 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1588 Malicious code in bitcore-payment-codes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa0ec63e3e51f3e4f619b36b2eff6deb717e85cc3248f1514efd778ef4a1001c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bitcore-payment-codes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa0ec63e3e51f3e4f619b36b2eff6deb717e85cc3248f1514efd778ef4a1001c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in payment_method (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcaf8d7ef9b2e7d4df92b29894c629acbc28978ee0fc89ae8d1b8ce4f45268d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5237 Malicious code in payment_method (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcaf8d7ef9b2e7d4df92b29894c629acbc28978ee0fc89ae8d1b8ce4f45268d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in local-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31a992354896d33abba2d61796cc31480bede54062f77b518168d3a18adf5bf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4353 Malicious code in local-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31a992354896d33abba2d61796cc31480bede54062f77b518168d3a18adf5bf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WooCommerce < 6.6.0 - Admin+ Stored HTML Injection

The plugin is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles PoC Go to WooCommerce - Settings - Payments tab, enable BAC Bank Account Transfers and edit the title in the setup dialog. HTML can be injected there, and will be rendered both f...

Student Registration and Fee Payment System SQL Injection Vulnerability

Student Registration and Fee Payment System is a student registration and fee payment management system. student registration and fee payment system v1.0 is vulnerable to SQL injection, which originates from /scms/student. php is missing SQL data filtering and escaping. An attacker could use this...

The owner can set arbitrarly high fees

Lines of code Vulnerability details Impact The owner of InfinityExchange contract can set arbitrarly big fees, and coul stole funds from seller. Proof of Concept When an order is executed the payment and the transfer from buyer to seller and viceversa are done by transferNFTsAndFees function wich...

Extra msg.value in takeOrders

Lines of code Vulnerability details Impact In takeOrders, msg.sender can pay the items in ether or other native coins. // check to ensure that for ETH orders, enough ETH is sent // for non ETH orders, IERC20 safeTransferFrom will throw error if insufficient amount is sent if isMakerSeller &&...

CVE-2022-31246

paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request e.g., within QR code data. On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename...

CVE-2022-31246

paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request e.g., within QR code data. On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename...

CVE-2022-31246

paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request e.g., within QR code data. On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename...