740 matches found
CVE-2022-40190
SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting XSS. The web application does not adequately sanitize request strings of malicious JavaScript. An attacker utilizing XSS could then execute malicious code in users’ browsers and steal sensitive...
The pledge creators might lose all of their funds by recoverERC20().
Lines of code Vulnerability details Impact There is a recoverERC20 function to withdraw ERC20 tokens from the contract. Currently, it checks if the token isn't an active reward token but it can be passed easily if the admin removes the reward token using removeRewardToken. So if the admin removes...
CVE-2022-41648
The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CNC machines. Authentication is not enabled by default for DNC communication. This vulnerability may allow an attacker to deny service on the production line,...
Threat Actors Target AWS EC2 Workloads to Steal Credentials
We found malicious samples attempting to steal Amazon Elastic Compute Cloud EC2 Workloads' access keys and tokens via typosquatting and the abuse of legitimate tools...
CVE-2022-41204
An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack...
SAP Commerce 输入验证错误漏洞
SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. This product supports sales management, marketing management, order management and operations management. An input validation error vulnerability exists in SAP Commerce versions 1905, 2005, 2105, 2011, and 2205, which ca...
Joomla EDocman 1.23.3 Cross Site Scripting Vulnerability
┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ Exploits ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : extensions.joomla.org │ │ Vendor : Ossolution Team │ │ Software :...
CVE-2022-37265
Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js...
CVE-2022-37265
Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js...
Prototype Pollution
steal is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the convertLater function of npm-convert.js and modify attributes such as proto, constructor, and prototype...
Why emergencyExecute() is required?
Lines of code Vulnerability details Impact Now PartyDAO multisig can steal all funds from all PartyGovernance instances If malicious user will get control over PartyDAO multisig, he will steal of funds from all projects Tools Used vs code Recommended Mitigation Steps Remove this funtion --- The...
CVE-2022-37258
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js...
Prototype Pollution
steal is vulnerable to prototype pollution. A remote attacker is able to pollute objects by passing a maliciously crafted payload through optionName variable in the getScriptOptions function in main.js...
Prototype Pollution
steal is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the module.exports function of babel.js and modify attributes such as proto, constructor, and prototype...
Regular Expression Denial Of Service (ReDoS)
steal is vulnerable to regular expression denial of service ReDoS attacks. A remote attacker is able to cause a system hang via supplying a maliciously crafted input through source or sourceWithComments variables in main.js...
Prototype Pollution
steal is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the convertLater function of npm-convert.js and modify attributes such as proto, constructor, and prototype...
steal vulnerable to Prototype Pollution via optionName variable
Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js...
GHSA-8F8G-9J73-7P82 steal vulnerable to Prototype Pollution via optionName variable
Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js...
CVE-2022-37260
CVE-2022-37260 describes a Regular Expression Denial of Service (ReDoS) in the StealJS module loader, specifically in steal 2.2.4 via the input variable in main.js. The CVSS 3.1 base score is 7.5 (HIGH), with attack vector NETWORK, attack complexity LOW, and no privileges or user interaction requ...
