Modifying the loan term setting can default existing loans

Lines of code Vulnerability details Summary Protocol admins can modify the loan term settings. This action can inadvertently default existing loans created under different terms. Impact Positions in the Particle LAMM protocol are created for a configurable period of time, defined by the LOANTERM...

Increase liquidity in close position may not cover original borrowed liquidity

Lines of code Vulnerability details Summary When a position is closed, there is no check to ensure that the effective added liquidity covers the original borrowed liquidity from the LP. Impact Closing a position in the Particle LAMM protocol must ensure that the borrowed liquidity gets fully adde...

The creator does not receive additional ether - it accumulates on the contract

Lines of code Vulnerability details Impact In some cases, the ERC20TokenEmitter contract may accumulate residual ether that was not sent to the creator. The contract does not have a function to pick up the remaining ether. When a user wants to buy tokens, he sends ether to the...

PT-2023-8146 · Unknown +4 · Spreadsheet::Parseexcel +4

Name of the Vulnerable Software and Affected Versions: Spreadsheet::ParseExcel version 0.65 Description: The issue is related to the evaluation of Number format strings within the Excel parsing logic, which allows for arbitrary code execution due to passing unvalidated input from a file into a...

malicious borrowers can follow reclaimLiquidity() then execute addPremium() to invalidate renewalCutoffTime

Lines of code Vulnerability details Vulnerability details LP can set renewalCutoffTime=block.timestamp by executing reclaimLiquidity, to force close position function liquidatePosition DataStruct.ClosePositionParams calldata params, address borrower external override nonReentrant ... if...

PT-2024-11: Local file Inclusion in Cacti

The vulnerability was identified in Cacti version 1.2.25 and below. It leads to the possibility of executing arbitrary code on the server. The vulnerability can be exploited by an authorized user using SQL injection and due to insufficient processing of the path to the included file. Vulnerabilit...

PT-2023-31140

Name of the Vulnerable Software and Affected Versions Hotel Management version 1.0 Description The issue concerns multiple authenticated Reflected Cross-Site Scripting vulnerabilities. Specifically, the children parameter of the "reservation.php" resource is copied into the HTML document as plain...

PT-2023-31343 · Unknown · Bcorp Shortcodes

Name of the Vulnerable Software and Affected Versions: BCorp Shortcodes versions 0.23 and earlier Description: The issue is related to the deserialization of untrusted data. This can potentially lead to security risks, as deserializing untrusted data can allow an attacker to execute malicious cod...

PT-2023-22257 · WordPress · Houzez

Name of the Vulnerable Software and Affected Versions: Houzez - Real Estate WordPress Theme versions prior to 2.8.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation...

PT-2023-31442 · Unknown · School Management System

Name of the Vulnerable Software and Affected Versions: School Fees Management System version 1.0 Description: A cross-site scripting XSS issue in the /management/class component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter...

CVE-2023-6931

A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perfevent's readsize can overflow, leading to an heap out-of-bounds increment or write in perfreadgroup. We recommend upgrading past commit...

DoS (Denial of Service) org.apache.avro:avro Dependency in Bamboo Data Center and Server

This High severity org.apache.avro:avro Dependency vulnerability was introduced in versions 9.2.1, 9.3.0, and 9.4.0 of Bamboo Data Center and Server. This org.apache.avro:avro Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allo...

PT-2023-7922 · Mozilla +9 · Thunderbird +9

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 115.6 Description: The issue is related to errors in handling OpenPGP cryptographic signatures. Exploitation of this issue may allow a remote attacker to perform a spoofing attack. When processing a PGP/MIME...

PT-2023-33005 · Unknown · Email Oauth 2.0 Proxy

Name of the Vulnerable Software and Affected Versions: Email OAuth 2.0 Proxy versions 2022-09-05 through 2023-12-18 Description: The issue allows an attacker to gain access to an account by renewing expired OAuth 2.0 client credentials grant flow authorization tokens without checking their validi...

PT-2023-31074 · Unknown · Button Generator

Name of the Vulnerable Software and Affected Versions: Button Generator – easily Button Builder versions n/a through 2.3.8 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on...

PT-2023-7884

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 9.6 Description The issue is related to OS command injection in OpenSSH, which might occur if a user name or host name has shell metacharacters and this name is referenced by an expansion token in certain situations...

PT-2025-31020 · Transpose · Transpose

Name of the Vulnerable Software and Affected Versions: transpose crate versions prior to 0.2.3 Description: The transpose crate contains a flaw that allows for an integer overflow through the input width and input height arguments. Recommendations: Update to transpose crate version 0.2.3 or later...

PT-2023-27900 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 2.0.3 Description: The issue allows unauthenticated access through the API endpoints "/api/snapshot" and "/api/get log file". This could potentially lead to a DoS attack or allow an attacker to retrieve arbitrary...

PT-2023-32804 · Hikvision · Hikvision Intercom Broadcasting System

Name of the Vulnerable Software and Affected Versions: Hikvision Intercom Broadcasting System version 3.0.3 20201113 RELEASEHIK Description: A vulnerability was found in the Log File Handler component, affecting an unknown part of the file access/html/system.html. The manipulation leads to...

PT-2023-11481 · Uffizio · Uffizio'S Gps Tracker

Name of the Vulnerable Software and Affected Versions: Uffizio's GPS Tracker all versions Description: An improper access control issue exists, leading to sensitive information disclosure of connected devices. Visiting the vulnerable host at port 9000 returns a JSON body with details about deploy...