Upgraded Q -> M from #404 [1674736594739]

Judge has assessed an item in Issue 404 as M risk. The relevant finding follows: L‑04 latestAnswer is deprecated Use latestRoundData instead so that you can tell whether the answer is stale or not. The latestAnswer function returns zero if it is unable to fetch data, which may be the case if...

Upgraded Q -> M from #658 [1674423084300]

Judge has assessed an item in Issue 658 as M risk. The relevant finding follows: L-04 USDT IS NOT SUPPORTED FOR CALLING Trading.handleDeposit FUNCTION ON ETHEREUM MAINNET As shown by , USDT on the Ethereum mainnet does not allow approving a new amount when the existing approved amount is not zero...

PT-2023-18856 · Gpac · Gpac

Name of the Vulnerable Software and Affected Versions: GPAC version 2.2-rev0-gab012bbfb-master Description: The issue is related to an integer overflow vulnerability in the Q DecCoordOnUnitSphere function, located in the bifs/unquantize.c file. This vulnerability can be exploited, but details abo...

PT-2023-15095 · Nexusphp · Nexusphp

Name of the Vulnerable Software and Affected Versions: NexusPHP versions prior to 1.7.33 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to reflective cross-site scripting XSS attacks. This can be achieved by injecting malicious input int...

q-bar-dueren.de Cross Site Scripting vulnerability OBB-3159144

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross site scripting

A vulnerability was found in saemorris TheRadSystem. It has been classified as problematic. Affected is an unknown function of the file users.php. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. VDB-218454 is the identifier assigned ...

PT-2023-16181 · Unknown · Theradsystem

Name of the Vulnerable Software and Affected Versions: saemorris TheRadSystem affected versions not specified Description: A problematic issue has been identified, affecting an unknown function of the file users.php. The manipulation of the q argument leads to cross-site scripting. This issue can...

saemorris TheRadSystem 跨站脚本漏洞

TheRadSystem is a Cmput 391 project by saemorris Individual Developer. A cross-site scripting vulnerability exists in saemorris TheRadSystem, which stems from a problem with an unknown function in the file users.php, which can be exploited by an attacker to manipulate the parameter q to cause...

Upgraded Q -> M from #172 [1673039408650]

Judge has assessed an item in Issue 172 as M risk. The relevant finding follows: L-02 --- The text was updated successfully, but these errors were encountered: All reactions...

Code injection

A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/codecallercontroller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/ leads to code injection. The exploit has...

PT-2023-10188 · Unknown · Interchange

Name of the Vulnerable Software and Affected Versions: nterchange versions up to 4.1.0 Description: A critical issue affects the function getContent of the file app/controllers/code caller controller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/ leads to code...

PT-2022-11671 · Unknown · Studygolang

Name of the Vulnerable Software and Affected Versions: studygolang affected versions not specified Description: A problematic vulnerability was found in studygolang, affecting the Search function of the file http/controller/search.go. The manipulation of the argument q leads to cross-site...

Upgraded Q -> M from #4 [1671527898955]

Judge has assessed an item in Issue 4 as M risk. The relevant finding follows: GroupBuy.contribute does not set pendingBalances for unused capital, leading to locked up money --- The text was updated successfully, but these errors were encountered: All reactions...

GHSA-5X79-W82F-GW8W Inefficient Regular Expression Complexity in rails-html-sanitizer

Summary Certain configurations of rails-html-sanitizer = 1.4.4. Severity The maintainers have evaluated this as High Severity 7.5 CVSS3.1. References - CWE - CWE-1333: Inefficient Regular Expression Complexity 4.9 - https://hackerone.com/reports/1684163 Credit This vulnerability was responsibly...

LinkedIn: Delete any LinkedIn comment on learning API of other users

Vulnerability description not provided...

CVE-2022-39915

Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q10, 12.2.11.3000 in Android R11, 12.3.07.2000 in Android S12, and 12.4.02.0 in Android T13 allows attackers to access sensitive information via implicit intent...

CVE-2022-39915

CVE-2022-39915 is an improper access control vulnerability in the Samsung Calendar app. It affects Calendar versions prior to: Android Q 11.6.08.0, Android R 12.2.11.3000, Android S 12.3.07.2000, and Android T 12.4.02.0, where an attacker could access sensitive information via implicit intent. Th...

Upgraded Q -> M from #508 [1670444214372]

Judge has assessed an item in Issue 508 as M risk. The relevant finding follows: 508 --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> M from #76 [1670347574630]

Judge has assessed an item in Issue 76 as M risk. The relevant finding follows: L02 address.callvalue:x should be used instead of payable.transfer Impact The use of payable.transfer is heavily frowned upon because it can lead to the locking of funds. The transfer call requires that the recipient...

Enhancesoft osTicket 跨站脚本漏洞

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, Inc. in the United States. A security vulnerability exists in Enhancesoft osTicket versions prior to 1.16.4. The vulnerability stems from setting an ordinary user's username as the XSS payload, and then placing the same XSS...