PT-2023-19597 · Jenkins · Jenkins Jira Pipeline Steps Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JIRA Pipeline Steps Plugin versions 2.0.165.v8846cf59f3db and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially...

CVE-2023-24439

CVE-2023-24439 affects Jenkins JIRA Pipeline Steps Plugin (versions up to 2.0.165.v8846cf59f3db). The vulnerability arises from storing private keys unencrypted in the plugin’s global configuration file on the Jenkins controller (org.thoughtslive.jenkins.plugins.jira.JiraStepsConfig.xml), which c...

CVE-2023-24438

The CVE-2023-24438 issue affects Jenkins JIRA Pipeline Steps Plugin versions 2.0.165.v8846cf59f3db and earlier. The root cause is a missing permission check in methods handling form validation, enabling attackers with Overall/Read to connect to an attacker-specified URL using attacker-specified c...

stored XSS through Question sending

Dear Ladies and Gentlemen, First of all, thank you for your time and effort in reading my Report. While doing the Penetration Test my Brother Ahmed Hassan [email protected] and I were able to identify another stored XSS Cross-Site-Scripting Injection Vulnerability. The Process of the...

Stored XSS - allows stealing Admin and Users Cookies

Dear Ladies and Gentlemen, First of all thank you for your time and effort in reading my Report. While doing the Penetration Test my Brother Ahmed Hassan [email protected] and I were able to identify a stored XSS Cross-Site-Scripting Vulnerability. The Process of the Vulnerability: Login ...

_verifyTime function does not handle startTime > endTime

Lines of code Vulnerability details Impact A possible scenario where the verifyTime function could cause unexpected behavior is if the input parameters startTime and endTime are not correctly set by the user or another contract. If startTime is greater than endTime, the function would return vali...

ReturndataPointer Out of Bounds: A Recipe for Disaster

Lines of code Vulnerability details Impact This vulnerability allows an attacker to read or write to arbitrary memory locations by passing an out-of-bounds 'ReturndataPointer' value to the functions in the 'ReturndataReaders' and 'MemoryReaders' libraries. This can potentially lead to sensitive...

Lack of Input Validation: Unchecked Inputs Allowing for Malicious Data and Unexpected Behavior

Lines of code Vulnerability details Impact The contract does not perform any checks on the inputs passed to the functions, which could allow an attacker to pass malicious data and trigger unexpected behavior or errors. function readInt208 ReturndataPointer rdPtr internal pure returns int208 value...

Upgraded Q -> M from #164 [1674419095024]

Judge has assessed an item in Issue 164 as M risk. The relevant finding follows: LOW‑1 The Contract Should approve0 First Some tokens like USDT L199 do not work when changing the allowance from an existing non-zero allowance value. They must first be approved by zero and then the actual allowance...

Upgraded Q -> M from #100 [1674425909347]

Judge has assessed an item in Issue 100 as M risk. The relevant finding follows: Lines of code Vulnerability details Impact The wrong amount of LP tokens will be minted and the wrong amount of A/B tokens will be deposited. Proof of Concept According to the PDF document provided, the number of LP...

Incorrect Encoding of Order Hashes

Lines of code Vulnerability details Impact The order hashes are incorrectly encoded during the encodeOrderHashes mechanism, causing functions such as encodeRatifyOrder and encodeValidateOrder to misbehave. Proof of Concept The order hashes encoding mechanism appears to be incorrect as the...

Lack of proper input validation in fulfillAvailableAdvancedOrders function

Lines of code Vulnerability details Impact fulfillAvailableAdvancedOrders function is designed to fulfill orders on the marketplace, an attacker could pass an AdvancedOrder struct with a much higher value than the intended order, allowing them to gain an unfair advantage, or they could pass a...

SWC-109 Uninitialized Storage Pointer

Lines of code Vulnerability details Impact Uninitialized local storage variables can point to unexpected storage locations in the contract, which can lead to intentional or unintentional vulnerabilities. Proof of Concept Exploit Vulnerability OrderStatus storage orderStatus; Tools Used github...

SWC-109 Uninitialized Storage Pointer

Lines of code Vulnerability details Impact Uninitialized storage variables can point to unexpected storage locations. Proof of Concept // Exploitable Vulnerability MemoryPointer callData; Tools Used github Recommended Mitigation Steps // Initialize variable "callData" or set the storage attribute...

Reentrancy Vulnerability in _performFinalChecksAndExecuteOrders function

Lines of code Vulnerability details Impact bytes memory accumulator = new bytesAccumulatorDisarmed; and transferitem, execution.offerer, execution.conduitKey, accumulator; The code uses an "accumulator" variable that is used in the transfer function. The accumulator is created using the line byte...

Reentrancy

Lines of code Vulnerability details Impact An attacker can be the owner of conduitcontroller contract Proof of Concept function acceptOwnership has re-entrancy vulnerability Look at this : function acceptOwnership Executes twice to make the caller as owner. Look at this = emit OwnershipTransferre...

Stored HTML Injection

Team, I hope you are all doing well. . I wanted to bring to your attention a potential vulnerability on the website https://mainnet.demo.btcpayserver.org/account/apikeys. . During my research, I discovered that the api key label field is vulnerable to a stored HTML injection attack. Proof of...

OracleLib: Price can be negative

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- The...

Cross-chain replay attacks are possible with delegateBySig

Lines of code Vulnerability details If a user does a delegateBySig using the wrong network, an attacker can replay the action on the correct chain, and steal the funds a-la the wintermute gnosis safe attack, where the attacker can create the same address that the user tried to, and steal the fund...

Compilation Error: Undefined function 'shiftl_toFix' in CTokenFiatCollateral Contract

Lines of code Vulnerability details Impact return shiftltoFixrate, shiftLeft; It should be noted that the function "shiftltoFix" is not defined in the contract and not imported from any library, this means that the compiler will throw an error when trying to deploy the contract and this function...