withdrawFee should only be allowed to called once.

Lines of code Vulnerability details Impact In the current implementation, the function withdrawFee can be called multiple times. It should only be allowed to called once. Calling more than once would let owner steal from legit users as there won’t be enough funds left for legit users to claim...

PT-2023-19384 · Nosh · Nosh

Name of the Vulnerable Software and Affected Versions: NOSH version 4a5cfdb Description: The issue allows stored XSS via the create user page. For example, a first name of a physician, assistant, or billing user can have a JavaScript payload that is executed upon visiting the "/users/2/1" page...

PT-2023-19089 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.43.7.1 Metabase versions prior to 1.43.7.1 Metabase versions prior to 0.44.6.1 Metabase versions prior to 1.44.6.1 Metabase versions prior to 0.45.2.1 Metabase versions prior to 1.45.2.1 Description: The issue is...

PT-2023-16364 · Unknown · Sourcecodester Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Tours & Travels Management System version 1.0 Description: A critical issue has been found in the system, affecting the processing of the file admin/practice pdf.php. The manipulation of the id argument leads to SQL...

PT-2023-14421 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS version 7.64 Description: The issue is related to a Path Traversal that leads to a Local File Inclusion. A function is called to check the parameter inserted by the user for malicious characters, but this check is insufficient. An...

UBUNTU-CVE-2023-23613

OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security FLS and field masking where rules written to explicitly exclude fields are not correctly applied for certain queries that rely on their...

PT-2023-1800 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.7 and earlier Description: The issue is related to a Stack-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...

PT-2023-13931 · Siretta · Siretta Quartz-Gold

Name of the Vulnerable Software and Affected Versions: Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 Description: Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality. A specially-crafted network packet can lead to arbitrary command...

PT-2023-13935 · Siretta · Siretta Quartz-Gold

Name of the Vulnerable Software and Affected Versions: Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 Description: The issue concerns stack-based buffer overflow vulnerabilities in the DetranCLI command parsing functionality. These vulnerabilities can be triggered by a specially-crafted netwo...

PT-2023-13923

Name of the Vulnerable Software and Affected Versions Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 Description The issue concerns stack-based buffer overflow vulnerabilities in the DetranCLI command parsing functionality. These vulnerabilities can be triggered by a specially-crafted network...

TimeswapV2LiquidityToken: collect() will always revert because it uses the wrong parameters when calling ITimeswapV2Pool.transferFees()

Lines of code Vulnerability details Proof of Concept collect uses the wrong paramenters when calling ITimeswapV2Pool.transferFees. It uses long0Fees, long1Fees, and shortFees instead of param.long0FeesDesired, param.long1FeesDesired, and param.shortFeesDesired. The former 3 are defined in the...

The transferFeesFrom function does not check if the "from" address is the actual owner of the position before transferring the fees.

Lines of code Vulnerability details Impact The code Doesn't check if the from address is the owner of the position before transferring the fees. If the from address is not the owner of the position, an attacker could potentially transfer fees from another user's position without their permission...

Upgraded Q -> M from #229 [1674661320954]

Judge has assessed an item in Issue 229 as M risk. The relevant finding follows: Centralization Risk Contract: Impact: It seems the poolAdmin holds too much power including changing reward controller, rescue tokens etc. This can allow poolAdmin to impact all users by changing the config or draini...

Upgraded Q -> M from #374 [1674664049404]

Judge has assessed an item in Issue 374 as M risk. The relevant finding follows: L-03 WETHGateway.repayETH will revert if msg.value paybackAmount In the repayETH function, paybackAmount eth will be deposit to WETH contract to get paybackAmount weth back. WETH.depositvalue: paybackAmount; And then...

CVE-2023-23612 Issue with whitespace in JWT roles in OpenSearch

OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider IdP when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are processed from the JWTs where the leading and...

PT-2023-12863 · Netiq · Netiq Identity Manager

Name of the Vulnerable Software and Affected Versions: NetIQ Identity Manager versions prior to 4.8.5 Description: The issue allows an attacker to determine whether a file exists on the filesystem. This is a file existence disclosure vulnerability in the NetIQ Identity Manager plugin...

PT-2023-19614 · Jenkins · Jenkins Testquality Updater Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins TestQuality Updater Plugin version 1.3 and earlier Description: The issue concerns the storage of the TestQuality Updater password in the global configuration file on the Jenkins controller. This password is stored unencrypted, allowi...

PT-2023-19075 · Unknown +1 · Opensearch +1

Name of the Vulnerable Software and Affected Versions: OpenSearch versions 1.0.0 through 1.3.7 OpenSearch versions 2.0.0 through 2.4.1 Description: There is an issue in the implementation of field-level security FLS and field masking where rules written to explicitly exclude fields are not...

PT-2023-19613 · Jenkins · Jenkins Testquality Updater Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins TestQuality Updater Plugin versions 1.3 and earlier Description: A missing check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password...

PT-2023-16287 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2022.3.29 through 2022.3.30 Description: The issue arises when the force offline MFA prompt setting is not respected in offline mode, allowing users to save sensitive data on disk. Recommendations:...