MAL-2024-12271 Malicious code in fasdghjkhjafsd (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2384ead182322f38776720b4406ef7589305cdd61f49fa6ae98ae31288b447b2 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-prices-txt-exfiltration Reasons based on the campaign...

TEMU sued for being “dangerous malware” by Arkansas Attorney General

Chinese online shopping giant Temu is facing a lawsuit filed by State of Arkansas Attorney General Tim Griffin, alleging that the retailers mobile app spies on users. “Temu purports to be an online shopping platform, but it is dangerous malware, surreptitiously granting itself access to virtually...

EventPrime < 3.3.5 - Unauthenticated Booking Price Manipulation

Description The plugin is vulnerable to booking price manipulations due to insufficient validation and control of booking prices in versions up to, and including, 3.3.4. This makes it possible for unauthenticated attackers to make bookings with lower prices...

Deepfake Threat: $2 Deceptive Content Undermines Election Integrity

By Deeba Ahmed In 2024, over 60 countries worldwide are holding elections. The most significant threat to the integrity of these elections? Deepfake videos, readily accessible on the dark web and Telegram, with prices ranging from as low as $2 to $100. This is a post from HackRead.com Read the...

CVE-2023-6855

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of membership levels created by the plugin due to an incorrectly implemented capability check in the pmprorestapigetpermissionscheck function in...

CVE-2022-34344

Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles,...

CVE-2022-34344 WordPress Wholesale Suite Plugin <= 2.1.5 is vulnerable to Broken Access Control

Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles,...

Slippage protection missing

Lines of code Vulnerability details The MaxHeap contract does not check for slippage when updating item values. This could enable the admin to manipulate asset prices. Recommendation: Implement slippage protection by adding min/max checks in updateValue: function updateValueuint256 itemId, uint25...

Missing pause checks in LRTOracle

Lines of code Vulnerability details Summary The LRTOracle oracle provides functionality to pause the contract but no restrictions are applied when the contract is in a paused state. Impact Similar to the other contracts in the protocol, the LRTOracle contract offers pausing functionality: 101: //...

calculateAPR and estimateAPR may return invalid results

Lines of code Vulnerability details Impact The capitalForScore function in the Prime contract calculates the capital for calculation of score using a price oracle. The function is called three times inside of the contract, where only in the calculateScore is the oracle updated using the following...

The price update timestamp doesn't get checked, allowing for the use of stale prices

Lines of code Vulnerability details Impact It allows for the use of stale prices in cases where they will either damage the protocol or the user. Proof of Concept The protocol has a price oracle system where the price gets updated by an account with a privileged role by calling updatePrice...

Assumptions are currently made that prices would forever be positive

Lines of code Vulnerability details Impact Neglecting the potential for negative asset prices can lead to inaccurate value representation in the Liquidity Pool, possibly affecting calculations related to assets and tokens. It's crucial to note that the value of an asset, even if negative in the...

getLpPriceInEth and getRdpxPriceInEth return prices in 1e18 decimals, but we use it as 1e8 decimals

Lines of code Vulnerability details Impact Wrong decimals/price if we use RdpxEthOracle.sol as the oracle. Proof of Concept rdpx/eth oracle is not in the scope of this audit, so we can assure they are correct and only check if we use the API right. According to...

A difference in the rDPX price between the oracle and DEXs used for trading can cause more slippage than expected

Lines of code Vulnerability details Impact The protocol will experience much higher slippage than supposed to due to using the wrong price in calculating the amount after slippage. Proof of Concept The protocol executes swaps on Uniswap and Curve. The issue arises due to the protocol using its ow...

WordPress Book BuyBack Prices Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)

Software Book BuyBack Prices Type Plugin Vulnerable versions = 1.0.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e68b28ee80c9 Credits Rafie Muhammad Patchstack...

Malicious code in coingecko-prices (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bee7aadebfb8b0a1f20f634d7079ec48f9ce73ecb3ca8dbf9d4c55cd2c7d402 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-199 Malicious code in coingecko-prices (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bee7aadebfb8b0a1f20f634d7079ec48f9ce73ecb3ca8dbf9d4c55cd2c7d402 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kraken-prices (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4a67a11785828e7b3f7489127f8e07868a2e871b01726d0ddd2142345f94bb96 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

LACK OF deadline CHECK COULD PROMPT DELAYED EXECUTION OF swap OPERATION

Lines of code Vulnerability details Impact The RewardHandler.sellRewards function is used by governance and trusted sellers to sell reward tokens for collateral tokens. This function ensures that none of the collateral should be decreased after the swap by checking their respective balances befor...

MAL-2023-1559 Malicious code in kucoin-prices (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d89308a1cad90c22ac679c64ba69b184cebb0082f7d26962c26916f94b14fe1a Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...