globalindustrialsurplus.com.xx3.kz Cross Site Scripting vulnerability OBB-3948140

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Scaling Issue in AccountingEngine.auctionSurplus Causing Token Drains

Lines of code Vulnerability details Impact The impact of this vulnerability is significant as it leads to a scaling problem in surplus auctions conducted by the AccountingEngine. The vulnerability arises from the way the amountToSell in surplusAuctionHouse.startAuction call and rad in...

surplusTransferPercentage will always be less than 1%

Lines of code Vulnerability details Impact The protocol has a feature to auction the surplus amount and send some % out of that to extraSurplusReceiver but currently this % always less than 1% which limits the amount extraSurplusReceiver can get out of the surplus Proof of Concept we believe this...

AccountingEngine can only transfer a maximum of 1% of the surplus to the designated extraSurplusReceiver

Lines of code Vulnerability details Impact The impact of this vulnerability is related to the validation of the surplus transfer percentage in the AccountingEngine contract. The vulnerability arises from an incorrect validation check that restricts the surplus transfer percentage to WAD 1%. Proof...

Basket range formula is inefficient, leading the protocol to unnecessary haircut

Lines of code Vulnerability details Impact The BackingManager.manageTokens function checks if there's any deficit in collateral, in case there is, if there's a surplus from another collateral token it trades it to cover the deficit, otherwise it goes for a 'haircut' and cuts the amount of basket...

Surplus token after adding liquidity is not refunded to liquidity providers. LP might suffer front-running attack and lose funds.

Lines of code Vulnerability details Impact Function Pair.add receives base token and fractional token from liquidity providers and mint equivalent amount of LP token for them. The amount of LP token be minted is calculate in function addQuote function addQuoteuint256 baseTokenAmount, uint256...

FixedPricePassThruGate.sol All the msg.value should be pass thru to gate.beneficiary instead of gate.ethCost

Lines of code Vulnerability details In FixedPricePassThruGate.solpassThruGate, at L48 the msg.value is checked to be = gate.ethCost instead of == gate.ethCost, which makes it possible for the caller to send more than gate.ethCost. However, at L53 only the amount of gate.ethCost is passed thru to...

Interest surplus is accumulated on Master accounting update in TurboSafe.less

Lines of code Vulnerability details Impact There will be an interest surplus accumulating in all the master accounting variables totalBoosted, getTotalBoostedForVault and getTotalBoostedAgainstCollateral. As getTotalBoostedForVault and getTotalBoostedAgainstCollateral are used in the checks again...

Incorrect TCR calculation in batchLiquidateTroves() during Recovery Mode

TCR is temporarily miscalculated in the batchLiquidateTroves function during Recovery Mode. The bug lies in batchLiquidateTroves of TroveManager. When calculating system's entire collateral, we should also exclude the liquidated trove's surplus collateral, since liquidation closes the trove and...

Command Execution Vulnerability in Surplus Vision HD Recording System

Guangzhou Ncast Electronic Technology Co., Ltd hereinafter referred to as Ncast, founded in 2007, is a high-tech enterprise focusing on three major fields of multimedia communication, video and audio coding and decoding, and intelligent image processing. There is a command execution vulnerability...

Arbitrary File Download Vulnerability in Surplus Visual Recording and Broadcasting System

Guangzhou Ncast Electronic Technology Co., Ltd hereinafter referred to as Ncast, founded in 2007, is a high-tech enterprise focusing on three major fields of multimedia communication, video and audio coding and decoding, and intelligent image processing. Ncast's recording and broadcasting system...

surplus-chemicals.biz Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1064320 Security Researcher geeknik Helped patch 8687 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting surplus-chemicals.biz...

catalog.surplusequipment-stl.com XSS vulnerability

Open Bug Bounty ID: OBB-487896 Description| Value ---|--- Affected Website:| catalog.surplusequipment-stl.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6....

surplus.eri.ucsb.edu XSS vulnerability

Vulnerable URL: http://surplus.eri.ucsb.edu/inventory.php?category=13'"10 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 05.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinate...

dasapps.ohio.gov XSS vulnerability

Vulnerable URL: http://dasapps.ohio.gov/surplus/auto/Inventory.asp?InventNum=1"...

armysurpluswarehouse.com XSS vulnerability

Vulnerable URL: http://www.armysurpluswarehouse.com/catalogsearch/result/?q=army cot'"--!...

SUSE-SU-2016:1733-1 Security update for glibc

This update for glibc provides the following fixes: - Increase DTVSURPLUS limit. bsc968787 - Do not copy dname field of struct dirent. CVE-2016-1234, bsc969727 - Fix memory leak in nssdnsgethostbyname4r. bsc973010 - Fix stack overflow in nssdnsgetnetbynamer. CVE-2016-3075, bsc973164 - Fix malloc...

Remnants HVAC surplus - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Remnants HVAC surplus published at the 'play' market has multiple vulnerabilities...