Bidder can steal all the base token by repeatedly calling finalize()

Lines of code Vulnerability details Impact All the base token will be stolen by malicious bidder, even worse the bidder might pay nothing at the end. Proof of Concept Anyone can call finalize, and it can be called multiple times. FinalizeData memory data is local, which means in each call, data i...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE that originates from a malicio...

Compromised or malicious owner of WardenPledge contract can steal pledge creator's deposited reward token amount

Lines of code Vulnerability details Impact There is no guarantee that the owner of the WardenPledge contract does not become compromised or malicious in the future. If this owner becomes compromised or malicious, after a pledge is created and the corresponding reward token amount is deposited, su...

[M1] Owner can steal any createdPledge's tokens

Lines of code Vulnerability details Impact Malicious owner can steal any created pledge even to drain the whole contract Proof of Concept Functions like recoverERC20 are good to recover tokens accidentally transferred to a contract. The common approach for these function is to exclude real tokens...

Owner can steal all the rewards token from the WardenPledge.sol smart contract and break the internal accounting

Lines of code Vulnerability details Impact The owner of the WardenPledge.sol smart contract can steal all the reward tokens from the contract and break the internal accounting. With the recoverERC20 function, the owner can transfer to him/herself the whole balance of the token. The check at L654...

ExecutionDelegate can approve arbitrary calling contract

Lines of code Vulnerability details Impact Owner can steal users' funds and tokens. Proof of Concept The owner of ExecutionDelegate can approve any contract to call it, e.g. a malicious contract which can then drain all funds and tokens approved by users to ExecutionDelegate. Users should only...

Joomla Easy Shop 1.4.1 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

pcs: obtaining an authentication token for hacluster user could lead to privilege escalation

A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemons. A privilege escalation could happen by obtaining an authentication token for a hacluster user. With the "hacluster" token, this flaw...

PCS 安全漏洞

PCS is a Corosync and Pacemaker configuration tool open-sourced by ClusterLabs. PCS has a security vulnerability that stems from improperly configured permissions on Unix sockets used for internal communication between PCS daemons leading to an attacker who, by obtaining a hacluster user's...

WordPress plugin Stop Spam Comments 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

CVE-2022-35910

In Jellyfin before 10.8, stored XSS allows theft of an admin access token...

Cross site scripting

In Jellyfin before 10.8, stored XSS allows theft of an admin access token...

CVE-2022-35910

In Jellyfin before 10.8, stored XSS allows theft of an admin access token...

CVE-2022-35910: Improper Neutralization of Input During Web Page Generation

In Jellyfin before 10.8, stored XSS allows theft of an admin access token...

Don't trust in references contracts

Lines of code Vulnerability details Impact The references contracts don't check anything, and the function receive a lot of parameters to manipulate the call Proof of Concept If somebody approveERC20/777/721/1155 the TransferReference contract or use a delegatecall the tokens can be stolen...

CVE-2022-2353

Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...

Cross site request forgery (csrf)

Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...

CVE-2022-2353

Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...

CVE-2022-2353

CVE-2022-2353 affects microweber/microweber prior to v1.2.20. The root cause is improper neutralization of input, enabling an attacker to steal tokens and perform cross-site request forgery, fetch contents from the same-site, and redirect a user. Impact is described as token theft and CSRF-relate...

PT-2022-16055 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.2.20 Description: The issue is due to improper neutralization of input, allowing an attacker to steal tokens and perform cross-site request forgery, fetch contents from the same site, and redirect a...