Using incorrect parameter for checking the reserve

Lines of code Vulnerability details Impact At line 549 within the swap function's code, the internal call to the function checkBalances checks the reserve for token x is carried out using xi + specifiedAmount instead of xi + roundedSpecifiedAmount. When using roundedSpecifiedAmount passes the che...

Exploit for Insufficient Verification of Data Authenticity in Rarlab Winrar

winrarCVE-2023-38831lazypoc lazy way to create CVE-2023-388...

Kali Linux 2023.3 - Penetration Testing and Ethical Hacking Linux Distribution

Time for another Kali Linux release! – Kali Linux 2023.3. This release has various impressive updates. The highlights of the changelog since the 2023.2 release from May: Internal Infrastructure - Major stack changes is under way Kali Autopilot - The automation attack framework has had an major...

Cosmos: Circuit Breaker Authorization Issue

Vulnerability description not provided...

AD_Enumeration_Hunt - Collection Of PowerShell Scripts And Commands That Can Be Used For Active Directory (AD) Penetration Testing And Security Assessment

Description Welcome to the AD Pentesting Toolkit! This repository contains a collection of PowerShell scripts and commands that can be used for Active Directory AD penetration testing and security assessment. The scripts cover various aspects of AD enumeration, user and group management, computer...

Malicious code in matomo-screenshot-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc044c397b025c460ce571308d09c4bbbba7869abcc04f319cf219796f7a0666 The OpenSSF Package Analysis project identified 'matomo-screenshot-testing' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1507 Malicious code in matomo-screenshot-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc044c397b025c460ce571308d09c4bbbba7869abcc04f319cf219796f7a0666 The OpenSSF Package Analysis project identified 'matomo-screenshot-testing' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

Metasploit Weekly Wrap-Up

Meterpreter Testing This week’s release adds new payload tests to our automated test suite. This is intended to help the team and community members identify issues and behavior discrepancies before changes are made. Payloads run on a variety of different platforms including Windows, Linux, and OS...

JVN#46993816: EC-CUBE 2 series vulnerable to cross-site scripting

EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability CWE-79 in "mail/template" and "products/product" of Management page. Impact An arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the...

编号撤回

Damn Vulnerable Web Application DVWA is a very vulnerable PHP/MySQL web application by Robin Wood Personal Developer. Help security professionals test their skills and tools in a legal environment, help web developers better understand web application security processes, and help students and...

Microsoft Security Update Validation Report August 2023

Microsoft’s August 2023 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English only environments and issues August still be found upon implementation. Follow best practices for testing and installing...

Google Chrome DevTools Content Security Policy Bypass

The vulnerability of the DevTools set of tools for web development in Google Chrome exists due to insufficient testing of input data. Exploiting this vulnerability can allow a malicious actor to circumvent content security policies through a specially crafted HTML page...

Microsoft Visual Studio .NET Information Disclosure

The vulnerability of the Microsoft Visual Studio software and the Microsoft.NET platform is related to insufficient testing of input data. Exploiting this vulnerability can allow attackers to disclose sensitive information that should be protected...

Drinking Our Own Champagne: Enhancing API Security with FAST

Welcome to another inside story straight from the Wallarm labs. Today we’re taking you behind the scenes of our self-testing journey, showcasing how we "drink our own champagne" by implementing our Framework for Application Security Testing FAST to strengthen the security of our APIs. The intent ...

Continuous Security Validation with Penetration Testing as a Service (PTaaS)

Validate security continuously across your full stack with Pen Testing as a Service. In today's modern security operations center SOC, it's a battle between the defenders and the cybercriminals. Both are using tools and expertise – however, the cybercriminals have the element of surprise on their...

Vulnerability disclosure in aviation

We joined Boeing and United Airlines on a panel recently at the RSA Conference to talk about vulnerability disclosure in the aviation world. The engagement we are now seeing between researchers and industry is a powerful force for positive change. Hopefully this will start to reduce the number of...

test-submitting edit 24

Lines of code L1 Vulnerability details Testing to see if I can edit a finding I don't own Assessed type Access Control --- The text was updated successfully, but these errors were encountered: All reactions...

Design/Logic Flaw

MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for this issue...

CVE-2023-38494

CVE-2023-38494 affects MeterSphere Cloud interfaces; root cause is interfaces lacking configuration permissions, enabling sensitive data disclosure. Public details indicate versions prior to 2.10.4 LTS are affected; 2.10.4 LTS contains the patch. Remediation: upgrade to 2.10.4 LTS (or apply vendo...

CLSA-2023-1691083401 Fix CVE(s): CVE-2022-3697

SECURITY UPDATE: improper handling of towercallback parameter in amazon.aws collection - debian/patches/CVE-2022-3697.patch: ec2instance - validate options on towercallback - CVE-2022-3697 Enable unit testing...