Code injection

Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predictable URLs...

CVE-2018-15502

The CVE-2018-15502 entry concerns Lone Wolf Technologies loadingDOCS. An insecure permissions flaw in the 2018-08-13 version allows remote attackers to download confidential files by issuing HTTPS requests to predictable URLs. The root cause is inadequate access controls on resources, enabling un...

CVE-2018-15502

Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predictable URLs...

PT-2018-13060

Name of the Vulnerable Software and Affected Versions Lone Wolf Technologies loadingDOCS version 2018-08-13 Description The issue allows remote attackers to download confidential files via https requests for predictable URLs due to insecure permissions. Recommendations For version 2018-08-13,...

CVE-2018-15502: Incorrect Permission Assignment for Critical Resource

Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predictable URLs...

CVE-2018-15552

The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" which is private, yet predictable and readable by the eth.getStorageAt function. Therefore, it allow...

PT-2018-13082

Name of the Vulnerable Software and Affected Versions The Ethereum Lottery affected versions not specified Description The issue concerns the "PayWinner" function of a simplelottery smart contract implementation, which generates a random value. This value is influenced by the maxTickets variable,...

CVE-2018-15684

An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory /include/logs using predictable file names, which can lead to full path disclosure and leakage of sensitive data...

CVE-2018-15684

An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory /include/logs using predictable file names, which can lead to full path disclosure and leakage of sensitive data...

CVE-2018-15681

An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie, which is not flagged as HTTPOnly. Due to the weak and predictable salt that is in place, an attacker who successfully steals this cookie c...

Default credentials

An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie, which is not flagged as HTTPOnly. Due to the weak and predictable salt that is in place, an attacker who successfully steals this cookie c...

Design/Logic Flaw

An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory /include/logs using predictable file names, which can lead to full path disclosure and leakage of sensitive data...

CVE-2018-15681

An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie, which is not flagged as HTTPOnly. Due to the weak and predictable salt that is in place, an attacker who successfully steals this cookie c...

CVE-2018-15684

An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory /include/logs using predictable file names, which can lead to full path disclosure and leakage of sensitive data...

CVE-2018-15684

CVE-2018-15684 concerns BTITeam XBTIT where PHP error logs are stored in an open directory (/include/logs) with predictable filenames, enabling full path disclosure and leakage of sensitive data. The vulnerability is described across multiple sources (NVD/NVD-variants) indicating exposure of log ...

CVE-2018-15684: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory /include/logs using predictable file names, which can lead to full path disclosure and leakage of sensitive data...

PT-2018-13140

Name of the Vulnerable Software and Affected Versions BTITeam XBTIT version 2.5.4 Description An issue was discovered where the password hash of a user is rehashed using a predictable salt and stored in the pass cookie, which is not flagged as HTTPOnly. This allows an attacker who steals the cook...

Time Of Check To Time Of Use (TOCTOU)

chownr is vulnerable to the time of check to time of use TOCTOU race condition.The library uses predictable filenames in /tmp, allowing a malicious user to change the group ownership of an arbitrary file by replacing a non-symlink file with a symlink file during the execution of the chown command...

PT-2018-10977

Name of the Vulnerable Software and Affected Versions All For One affected versions not specified Description The issue concerns the maxRandom function of a smart contract implementation, which generates a random value using publicly readable variables. Since the seed value can be retrieved with ...

Cross site request forgery (csrf)

In csrf-magic before 1.0.4, if $GLOBALS'csrf''secret' is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used...