Mitigation of M-12: Issue NOT mitigated

Mitigated issue M-12: No slippage protection on stake in SafEth.sol There were issues with either a lack of slippage protection or a hard set slippage. Slippage protection was missing in deposit for Reth.deposit only if depositing in the Rocket Pool and in Reth.withdraw, as well as in stake becau...

Mitigation Confirmed for M-01

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-01: Issue not mitigated Link to Issue: code-423n4/2023-03-asymmetry-findings1078 Comments While the "division before multiplication" issues described in M-01 have been mitigated in the proposed changeset, there are other case...

PT-2023-19899 · Teplitsa · Teplitsa Yandex.News Feed

Name of the Vulnerable Software and Affected Versions: Teplitsa Yandex.News Feed by Teplitsa plugin versions 1.12.5 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions...

PT-2023-16350 · WordPress · Wp Login Box

Name of the Vulnerable Software and Affected Versions: WP Login Box WordPress plugin versions prior to 2.0.3 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, f...

PT-2023-16259 · WordPress · Cloud Manager Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Cloud Manager WordPress plugin versions 1.0 and earlier Description: The issue allows unauthenticated attackers to trick a logged-in admin into triggering a XSS payload by clicking a link, due to the lack of sanitization and escaping of the...

PT-2023-16634 · WordPress · Japanized For Woocommerce

Name of the Vulnerable Software and Affected Versions: Japanized For WooCommerce WordPress plugin versions prior to 2.5.8 Description: The issue is related to Reflected Cross-Site Scripting, where generated URLs are not properly escaped before being outputted in attributes. Recommendations: For...

PT-2023-23207 · Wjj · Innokb Server +1

Name of the Vulnerable Software and Affected Versions: WJJ Software - InnoKB Server, InnoKB/Console version 2.2.1 Description: The issue is related to reflected cross-site scripting RXSS through an unspecified request. This allows for potential malicious script injection and execution. No...

PT-2023-5348 · Libspdm · Libspdm

Name of the Vulnerable Software and Affected Versions: libspdm versions 1.0 through 2.3 Description: A vulnerability has been identified in SPDM session establishment in libspdm. If a device supports both DHE session and PSK session with mutual authentication, an attacker may be able to establish...

PT-2023-21757 · Macho Themes · Newsmag

Name of the Vulnerable Software and Affected Versions: Macho Themes NewsMag theme versions = 2.4.4 Description: The issue is related to a Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading...

PT-2023-12116 · Mblog · Mblog

Name of the Vulnerable Software and Affected Versions: mblog version 3.5.0 Description: The issue allows attackers to execute arbitrary code via a crafted theme when it gets selected. This is due to an OS Command injection vulnerability. Recommendations: For mblog version 3.5.0, update to a newer...

Potential XSS in content script via StackOverflow about_me

Description Alby has a feature called "batteries", which makes tipping on third party sites easier, e.g. by detecting lightning network addresses and so donating using the extensions becomes easy. One of those sites is stackoverflow. The alby extension will use the stackoverflow/stackexchange API...

PT-2023-20202 · Unknown · Sbs20/Scanservjs

Name of the Vulnerable Software and Affected Versions: sbs20/scanservjs versions prior to 2.27.0 Description: The issue is related to OS Command Injection in the GitHub repository sbs20/scanservjs. Recommendations: For versions prior to 2.27.0, update to version 2.27.0 or later to resolve the iss...

Cisco Warns of Vulnerability in Popular Phone Adapter, Urges Migration to Newer Model

Cisco has warned of a critical security flaw in SPA112 2-Port Phone Adapters that it said could be exploited by a remote attacker to execute arbitrary code on affected devices. The issue, tracked as CVE-2023-20126, is rated 9.8 out of a maximum of 10 on the CVSS scoring system. The company credit...

PT-2023-22545 · Unknown · Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: Online Food Ordering System version 2.0 Description: The issue allows attackers to execute arbitrary code via uploading a crafted PHP file, exploiting an arbitrary file upload vulnerability in the component "/admin/ajax.php?action=save menu"...

PT-2023-22519 · Totolink · Totolink A7100Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A7100RU version 7.4cu.2313 B20191024 Description: The issue is a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload. Recommendations: For TOTOLINK A7100RU version...

PT-2023-23177 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: Craft CMS versions 3.0.0 through 3.8.3 Craft CMS versions 3.8.4 is not affected for version 3, but versions prior to 4.4.4 are affected for version 4, so Craft CMS versions 4.0.0 through 4.4.3 Description: A malformed title in the feed widget...

PT-2023-20407 · WordPress · Eirudo Simple Youtube Responsive

Name of the Vulnerable Software and Affected Versions: Eirudo Simple YouTube Responsive plugin versions = 2.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher permissions. There is no information provided about the...

PT-2023-22536 · Unknown · Totaljs Flow

Name of the Vulnerable Software and Affected Versions: TotalJS Flow version 10 Description: A stored cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module. This issue...

PT-2023-18257 · Unknown · Factorytest

Name of the Vulnerable Software and Affected Versions: FactoryTest application prior to SMR May-2023 Release 1 Description: The issue is related to improper input validation in the FactoryTest application, allowing local attackers to achieve privilege escalation through debugging commands...

PT-2023-18238 · Google · Android

Name of the Vulnerable Software and Affected Versions: Call Settings versions prior to SMR May-2023 Release 1 Description: The issue allows physical attackers to access some media data stored in sandbox due to an improper export of android application components vulnerability in...