CVE-2020-19768

CVE-2020-19768 concerns ICOVO 1.0, where a lack of target address verification in the selfdestructs() function enables attackers to steal tokens from victim users via a crafted script. The issue is reported across multiple sources (NVD/Red Hat/CNVD/etc.) with the same core flaw. The connected doc...

CVE-2021-38707

Persistent cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session...

CVE-2021-38707

Persistent cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session...

CVE-2021-38704

Multiple reflected cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft...

CVE-2021-38704

Multiple reflected cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft...

Cross site scripting

Persistent cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session...

Cross site scripting

Multiple reflected cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft...

CVE-2021-38704

Multiple reflected cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft...

CVE-2021-38704

ClinicCases 7.3.3 is vulnerable to multiple reflected XSS vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript via a crafted URL, potentially leading to account takeover through session token theft. Affected product: ClinicCases 7.3.3. Root cause: insufficient input...

CVE-2021-38707

Persistent cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session...

ICOVO 数据伪造问题漏洞

ICOVO is a cross-platform solution that allows the use of tokens such as NFT on the OVO chain on Ether.ICOVO suffers from an input validation error vulnerability that stems from a lack of target address validation in the selfdestructs function, which can be exploited by attackers to steal tokens...

Rob The Bank 数据伪造问题漏洞

Rob The Bank is a music website. Rob The Bank suffers from a data forgery issue vulnerability that stems from the lack of destination address validation in the BurnMe function in Rob The Bank version 1.0, which allows an attacker to steal tokens from victimized users via a carefully crafted scrip...

CVE-2020-19768: Insufficient Verification of Data Authenticity

A lack of target address verification in the selfdestructs function of ICOVO 1.0 allows attackers to steal tokens from victim users via a crafted script...

0xRACER 输入验证错误漏洞

0xRACER is a new team-based pool lottery game. 0xRACER is vulnerable to an input validation error stemming from a lack of target address validation in the destroycontract function of 0xRACER version 1.0, which could be exploited by an attacker to steal a token from a victim user via a carefully...

CVE-2020-19769: Insufficient Verification of Data Authenticity

A lack of target address verification in the BurnMe function of Rob The Bank 1.0 allows attackers to steal tokens from victim users via a crafted script...

CVE-2020-19767: Undefined Security Weakness

A lack of target address verification in the destroycontract function of 0xRACER 1.0 allows attackers to steal tokens from victim users via a crafted script...

CVE-2021-38707: Improper Neutralization of Input During Web Page Generation

Persistent cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session...

CVE-2021-38704: Improper Neutralization of Input During Web Page Generation

Multiple reflected cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft...

PT-2021-10408

Name of the Vulnerable Software and Affected Versions: 0xRACER version 1.0 Description: A lack of target address verification in the destroycontract function allows attackers to steal tokens from victim users via a crafted script. This issue enables attackers to exploit the lack of verification,...

ClinicCases 跨站脚本漏洞

ClinicCases is an open source case management system designed for law school clinics. A cross-site scripting vulnerability exists in ClinicCases version 7.3.3 that stems from the software's lack of effective validation and filtering of user-submitted parameters. The vulnerability allows an...