Test manage-findings update with new cors

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- The...

Test for submit findings in api

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. dfdsf Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. efsdfsf Tools Used Recommended Mitigation...

xwiki-platform-web-templates vulnerable to Eval Injection

Impact Any user with edit rights on a page e.g., it's own user page, can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the information loaded from attachments in imported.vm, importinline.vm, and...

GHSA-HG5X-3W3X-7G96 xwiki-platform-web-templates vulnerable to Eval Injection

Impact Any user with edit rights on a page e.g., it's own user page, can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the information loaded from attachments in imported.vm, importinline.vm, and...

CVE-2023-27495 Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

RHEL 8 : curl (RHSA-2023:1842)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1842 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, a...

Unrestricted Token Transfer and Minting

Lines of code Vulnerability details Impact An attacker could exploit this vulnerability to mint an unlimited number of tokens, potentially devaluing the token and manipulating the market. Proof of Concept: Proof of Concept --The contract allows anyone to call the onTokenTransfer function without...

POSITION LIMIT COULD BE FULLY REDUCED TO ZERO BY CLONES

Lines of code Vulnerability details Impact A newly opened position could have its limit fully reduced to zero as soon as the cooldown period has elapsed. Proof of Concept As seen in the function below, a newly opened position with 0 Frankencoin minted could have its limit turn 0 if the function...

Minter and position privileges allow unrestricted minting and burning of arbitrary tokens

Lines of code Vulnerability details Any registered minter and a position belonging to him have absolute control of minting and burning tokens on all accounts. Impact New minting mechanisms are subject to governance approval i.e. can be veto’ed. These, however, will be arbitrary contracts with...

Challenges can be frontrun with de-leveraging to cause lossses for challengers

Lines of code Vulnerability details Impact Challenges, once created, cannot be closed. Thus once a challenge is created, the challenger has already transferred in a collateral amount and is thus open for losing their collateral to a bidding war which will most likely close below market price, sin...

can launch a challenge without any collateral in MintingHub.sol

Lines of code Vulnerability details Impact launchChallenge... function in MintingHub.sol ignores return value by challenge.position.collateral.transferFrom Several tokens do not revert in case of failure and return false. If the token used as collateral return false, the user can launch a challen...

function restructureCapTable() in Equity.sol not functioning as expected

Lines of code Vulnerability details Impact Incorrect typo in function restructureCapTable leading to only burning tokens of first address of addressToWipe array arguement. Proof of Concept Here, in L313, addressToWipe0 only takes first address of the array. While ignoring the rest and also since...

The minter can steal the Frankencoin in notifyLoss()

Lines of code Vulnerability details Impact The minter can steal the Frankencoin in notifyLoss because of In this code: if reserveLeft = amount transferaddressreserve, msg.sender, amount; The minter can call the function notifyLoss Constantly. When reserveLeft = amount, the minter who call the fir...

CVE-2023-20862

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the...

MaxContribution check can be bypassed to give a card high voting power

Lines of code Vulnerability details Proof of Concept ReraiseETHCrowdfund tries limit the voting power of each card by doing a min/maxContribution check in claim and claimMultiple. uint96 contribution = votingPower 1e4 / exchangeRateBps; uint96 maxContribution = maxContribution; // Check that the...

Constant product formula is not maintained in deposit() and withdraw() functions.

Lines of code Vulnerability details Impact As constant product formula is not followed, during deposit/withdraw, actualReserves - both actual NFT and BaseToken are updated but virtualReserves are not updated. This could lead to incorrect price deviation for the trader, most reverting their...

No check for minPrice and maxPrice in the deposit() function

Lines of code Vulnerability details Impact No check for minPrice and maxPrice in the deposit function could lead to unexpected consequences Proof of Concept In the function deposit function deposit address payable privatePool, address nft, uint256 calldata tokenIds, uint256 minPrice, uint256...

Jenkins Kubernetes Plugin does not properly mask credentials

Multiple Jenkins plugins do not properly mask i.e., replace with asterisks credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met: - The credentials are printed in build steps executing on an agent typically inside a node block. -...

Jenkins Thycotic DevOps Secrets Vault Plugin does not properly mask credentials

Multiple Jenkins plugins do not properly mask i.e., replace with asterisks credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met: - The credentials are printed in build steps executing on an agent typically inside a node block. -...

curl: HTTP multi-header compression denial of service

A flaw was found in the Curl package. A malicious server can insert an unlimited number of compression steps. This decompression chain could result in out-of-memory errors...