PT-2023-29900 · Unknown · Smart App Banner Plugin

Name of the Vulnerable Software and Affected Versions: Smart App Banner plugin versions 1.1.3 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject malicious scripts into the...

WordPress plugin Smart App Banner Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

The approve function can be frontrun

Lines of code Vulnerability details Impact Bob steals tokens from Alice. Proof of Concept In the file WildcatMarketToken.sol there is an approve function: function approveaddress spender, uint256 amount external virtual nonReentrant returns bool approvemsg.sender, spender, amount; return true; th...

GO-2023-2119 Proof forgery due to insufficient randomness in github.com/consensys/gnark

A a third party may derive a valid proof from a valid initial tuple proof, publicinputs, corresponding to the same public inputs as the initial proof. This vulnerability is due to randomness being generated using a small part of the scratch memory describing the state, allowing for degrees of...

WordPress Smart Online Order for Clover Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)

Software Smart Online Order for Clover Type Plugin Vulnerable versions = 1.5.4 Fixed in 1.5.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46312 Patch priority High CVSS severity High 7.1 Developer Zaytech PSID 99ef88d7e47d Credits thiennv Require...

CVE-2023-5684

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The attack can be launched remotely. The...

CVE-2023-5684

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The attack can be launched remotely. The...

Command injection

A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The attack can be launched...

CVE-2023-5684 Byzoro Smart S85F Management Platform importexport.php os command injection

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The attack can be launched remotely. The...

CVE-2023-5684 Byzoro Smart S85F Management Platform importexport.php os command injection

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The attack can be launched remotely. The...

CVE-2023-5684

CVE-2023-5684 affects Byzoro Smart S85F Management Platform (and related Beijing Baichuo variant) up to version 20231012. Affects an unknown functionality in /importexport.php, where manipulation leads to OS command injection. Impact is execution of commands with remote access; exploitation is po...

CVE-2023-5683

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btnfilerenew leads to os command injection. The attack may be initiated...

CVE-2023-5683

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btnfilerenew leads to os command injection. The attack may be initiated...

Command injection

A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btnfilerenew leads to os command injection. The attack may be...

CVE-2023-5683 Byzoro Smart S85F Management Platform importconf.php os command injection

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btnfilerenew leads to os command injection. The attack may be initiated...

PT-2023-32259 · Byzoro · Byzoro Smart S85F Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S85F Management Platform versions up to 20231010 Description: A critical issue affects the processing of the file /sysmanage/importconf.php. The manipulation of the btn file renew argument leads to os command injection. The attac...

Beijing Baichuo Smart S85F Management Platform Operating System Command Injection Vulnerability

Beijing Baichuo Smart S85F Management Platform is a management platform of Beijing Baichuo Company. Beijing Baichuo Smart S85F Management Platform suffers from an operating system command injection vulnerability, which stems from unknown processing in importexport.php, leading to operating system...

Smart Cookie Kit < 2.3.2 - Contributor+ Stored XSS

Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Cross-Chain Signature Replay Attack

Lines of code Vulnerability details Impact 1. User operations can be replayed on smart accounts accross different chains. This can lead to user's loosing funds or any unexpected behaviour that transaction replay attacks usually lead to. 2. Mistakes made on one chain can be re-applied to a new...

A malicious actor can Block stuff the chain until the validator signature expires.

Lines of code Vulnerability details Impact The signature of a validator is time bound of which after the expiration period the transaction becomes invalid, a malicious user might notice a time bound transaction made by the sub account and decide to block stuff the network until the validator...