4525 matches found
CVE-2020-24772
In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client and force it to open a remote SMB share. Windows will perform NTLM authentication when opening the SMB share and that request can be relaye...
CVE-2020-24772
In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client and force it to open a remote SMB share. Windows will perform NTLM authentication when opening the SMB share and that request can be relaye...
Open redirect
In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client and force it to open a remote SMB share. Windows will perform NTLM authentication when opening the SMB share and that request can be relaye...
CVE-2020-24772
In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client and force it to open a remote SMB share. Windows will perform NTLM authentication when opening the SMB share and that request can be relaye...
Github clash 访问控制错误漏洞
Github clash is a rule-based tunnel in Go. A security vulnerability exists in Github clash, which can be exploited by embedding a malicious iframe page into a website with a crafted URL that launches the Clash Windows client and forces it to open a remote SMB share. Windows will perform NTLM...
First depositor can break minting of shares
Lines of code Vulnerability details Details The attack vector and impact is the same as TOB-YEARN-003, where users may not receive shares in exchange for their deposits if the total asset amount has been manipulated through a large “donation”. Proof of Concept Attacker deposits 2 wei so that it i...
Strategy Migration May Leave Tokens in the Old Strategy Impacting Share Calculations
Lines of code Vulnerability details Impact If a strategy does not have sufficient funds to withdraw for the full amount then it is possible that tokens will be left in this yield contract during migrate. It is common for withdrawal from a strategy to withdraw less than a user's balance. The reaso...
The vulnerability in the application programming interface for data exchange via Web Share browsers like Google Chrome and Microsoft Edge allows a perpetrator to escalate their privileges.
The vulnerability of the application programming interface for data exchange via Web Share browsers like Google Chrome and Microsoft Edge is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...
WordPress Sassy Social Share plugin <= 3.3.39 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Paul J. Martinez in WordPress Sassy Social Share plugin versions = 3.3.39. Solution Update the WordPress Sassy Social Share plugin to the latest available version at least 3.3.40...
Sassy Social Share < 3.3.40 - Reflected Cross-Site Scripting
The plugin does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled which is the default setting, leading to a Reflected Cross-Site Scripting issue. Note: Vendor was notified on September 14th, 2021...
Lnkbomb - Malicious Shortcut Generator For Collecting NTLM Hashes From Insecure File Shares
Lnkbomb is used for uploading malicious shortcut files to insecure file shares. The vulnerability exists due to Windows looking for an icon file to associate with the shortcut file. This icon file can be directed to a penetration tester's machine running Responder or smbserver to gather NTLMv1 or...
Staking tokens can be stolen
Lines of code Vulnerability details Impact The staking contract keeps track of shares of each user. When withdrawing from the staking contract the amount parameter is converted to shares and this value is decreased shares = amount / totalbalance totalshare. This shares calculation rounds down whi...
WordPress Floating Social Share Icons and Social Share buttons – Next Previous Post Links – FL plugin <= 3.5.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Floating Social Share Icons and Social Share buttons – Next Previous Post Links – FL plugin versions = 3.5.9. Solution Update the WordPress Floating Social Share Icons and Social Share buttons – Next...
WordPress Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters plugin <= 1.7.0 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters plugin versions = 1.7.0. Solution Update the WordPress Go Viral – social share, social sharebar, social locker,...
WordPress Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters plugin <= 1.7.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters plugin versions = 1.7.0. Solution Update the WordPress Go Viral – social share, social...
WordPress Share This Image plugin <= 1.66 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Share This Image plugin versions = 1.66. Solution Update the WordPress Share This Image plugin to the latest available version at least 1.67...
WordPress Share This Image plugin <= 1.66 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Share This Image plugin versions = 1.66. Solution Update the WordPress Share This Image plugin to the latest available version at least 1.67...
CVE-2022-24633
All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/". A malicious actor could identify the existence of users by requesting share information on specified share paths...
FileCloud 信息泄露漏洞
FileCloud is an ultra-secure content collaboration platform from US-based FileCloud, Inc. offering industry-leading compliance, data governance, data leakage protection, data retention and digital rights management capabilities. FileCloud suffers from a security vulnerability that stems from the...
