soybase.org Cross Site Scripting vulnerability OBB-3177433

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

mint() function logic will break with fee-on-transfer(deflationary) tokens

Lines of code Vulnerability details Impact with deflationary token mint function never succeed Proof of Concept mint function checking if balanceAfter totalLiquidity revert CompleteUtilizationError; // next check is for the case when liquidity is borrowed but then was completely accrued if...

Successful get balance request to victim contract from attack contract and also costing the victim contract gas fees

Lines of code Vulnerability details Impact Successful get balance request to victim contract from attack contract and also costing the victim contract gas fees One can view the balance of the victim's contract without permission. URL:...

mintReceipt could mint receipt after endtime.

Lines of code Vulnerability details Impact mintReceipt could mint receipt after endtime. If owner execute withdrawRemainingTokens user’s receipt that mint after endtime can’t claim. Proof of Concept function withdrawRemainingTokensaddress to public override onlyOwner...

[SECURITY] Fedora 37 Update: rust-rd-hashd-2.1.2-7.fc37

Latency-sensitive pseudo workload for resctl-demo...

[SECURITY] Fedora 37 Update: rust-exa-0.10.1-9.fc37

exa is a modern replacement for the command-line program ls that ships with Unix and Linux operating systems, with more features and better defaults. It uses colours to distinguish file types and metadata. It knows about symlinks, extended attributes, and Git. And it=EF=BF=BD=EF=BF =BD=EF=BF=BDs...

Pinpoint Booking System < 2.9.9.2.9 - Subscriber+ SQLi

The plugin does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks. Note: A Calendar is needed if there is not one already. Run the below command in the develope...

A user can use the same proof for a commitment more than 1 time

Lines of code Vulnerability details Impact A user can use the same commitment signature and merkleData more than 1 time to obtain another loan. Proof of Concept A user needs to make some procedures to take a loan against an NFT. Normally the user calls commitToLiens in AstariaRouter.sol providing...

CVE-2023-21860

...

CVE-2023-21894

...

CVE-2023-21884

...

CVE-2023-21877

...

CVE-2023-21865

...

CVE-2023-21841

...

CVE-2023-21837

...

CVE-2023-21831

...

CVE-2023-21826

...

GSD-2023-1001558 s390/ctcm: Fix return type of ctc{mp,}m_tx()

s390/ctcm: Fix return type of ctcmp,mtx This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.337 by commit...

GSD-2023-1001407 hwrng: amd - Fix PCI device refcount leak

hwrng: amd - Fix PCI device refcount leak This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001264 ext4: disable fast-commit of encrypted dir operations

ext4: disable fast-commit of encrypted dir operations This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...