Frontrun attack to steal first depositor money

Lines of code Vulnerability details Impact Frontrun attack to steal first depositor money Proof of Concept The flow is as following: 1. The first depositor wants to deposit X. 2. We detect it and frontrun 2 operations: 1. We deposit 1 of the underlying to the system. In exchange we receive 1 shar...

CVE-2022-1429

SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data...

Sql injection

SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data...

CVE-2022-1339

SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data...

Sql injection

SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data...

admin can rug

Lines of code Vulnerability details In the function transferToken, the admin can steal all the money. --- The text was updated successfully, but these errors were encountered: All reactions...

[WP-H3] Proxy admin of the upgradeable proxy contracts can steal _borrowAsset and collateralAsset from the contracts and users' wallet

Lines of code Vulnerability details Both LenderPool and PooledCreditLine are upgradeable contract that holds users' allowances, and in certain periods, LendingPool will be holding users' funds. Use of Upgradeable Proxy Contract Structure allows the logic of the contract to be arbitrarily changed...

admin can rug

Lines of code Vulnerability details admin can steal all user funds --- The text was updated successfully, but these errors were encountered: All reactions...

Can steal collateral deposit

Lines of code Vulnerability details Impact The Collateral.deposit function mints initial shares equal to the deposited amount. The deposit / withdraw functions also use the strategyController.totalValue, which includes the strategy contract balance, to compute the shares. It's possible to increas...

[WP-H0] DEFAULT_ADMIN_ROLE of BribeVault can steal tokens from users' wallets

Lines of code Vulnerability details The current design/implementation allows the DEFAULTADMINROLE of BribeVault to steal funds from any address that approved this contract up to allowance: As a DEFAULTADMINROLE, the attack is simply do the following steps: 1. grantDepositorRole to self; 2...

Hot wallet hack: Hackers steal $18.7m from Animoca’s Lympo NTF platform

By Waqas The hackers gained access to NFT platform Lympos operational hot wallet on Monday and managed to steal 165.2… This is a post from HackRead.com Read the original post: Hot wallet hack: Hackers steal $18.7m from Animocas Lympo NTF platform...

backdoor in withdrawRedundant

Handle cmichel Vulnerability details The Vault.withdrawRedundant has wrong logic that allows the admins to steal the underlying vault token. function withdrawRedundantaddress token, address to external override onlyOwner if token == addresstoken && balance 0 // @audit they can rug users. let's sa...

Google Chrome 安全特征问题漏洞

Google Chrome is a Web browser from the U.S. company Google Google. Google Chrome is vulnerable to a security feature issue that exists due to an incorrect implementation of a vulnerability in automatically populating Google Chrome. A remote attacker could exploit the vulnerability to be able to...

Malicious code in bootstrap-feature (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3db5e43a78e41f050b0e265c951bc776e693abd20a01108e6c8ea2e15a5e7c4d Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

WordPress和WordPress 插件 SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. Quotes Collection Plugin is a WordPress open source application plugin. WordPress Quotes Collection Plugin has a S...

CVE-2021-37093

There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers steal short messages...

CVE-2021-37093: Undefined Security Weakness

There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers steal short messages...

CVE-2021-25983: Improper Neutralization of Input During Web Page Generation

In Factor App Framework & Headless CMS forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “tags” and “category” parameters in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

Malicious Package

coa is a malicious package. The package contains a preinstall script that would execute malicious Javascript code to steal passwords from various applications...

CVE-2021-42701

An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle MiTM attack. This could allow an attacker to obtain credentials and take over the user’s cloud account...