PT-2022-15338 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 7.0.2 Description: The issue allows HTML injection, as demonstrated by the MAIN MAX DECIMALS TOT parameter in the "admin/limits.php" endpoint. Recommendations: For Dolibarr version 7.0.2, consider restricting access to the...

Vader TWAP averages wrong

Handle cmichel Vulnerability details The vader price in LiquidityBasedTWAP.getVaderPrice is computed using the pastLiquidityWeights and pastTotalLiquidityWeight return values of the syncVaderPrice. The syncVaderPrice function does not initialize all weights and the total liquidity weight does not...

Missing access restriction on StabilityPool's receiveCollateral

Handle kenzo Vulnerability details StabilityPool's receiveCollateral should only be called by ActivePool, but that check is missing. Anybody can call it and update StabilityPool's total collateral variable. Impact Wrong amounts of total collateral in StabilityPool totalColl. As far as I can see,...

Japan Total System GroupSession 输入验证错误漏洞

Japan Total System GroupSession is a groupware project from Japan Total System to facilitate communication in businesses and organizations, designed to promote information sharing. A security vulnerability exists in GroupSession, which can be exploited by an attacker to access arbitrary files on...

JVN#79798166: Multiple vulnerabilities in GroupSession

GroupSession provided by Japan Total System Co.,Ltd. contains multiple vulnerabilities listed below. Incorrect Permission Assignment for Critical Resource CWE-732 - CVE-2021-20874 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N| Base Score: 7.5 CVSS v2|...

Japan Total System GroupSession 路径遍历漏洞

Japan Total System GroupSession is a groupware project from Japan Total System, Inc. that facilitates business and organizational communication and is designed to promote information sharing. A path traversal vulnerability exists in GroupSession, which arises when a network system or product fail...

Basket:handleFees(): fees are overcharged

Handle GiveMeTestEther Vulnerability details Impact The fee calculation is based on the totalSupply of the basket token. But some amount of the totalSupply represents the fees paid to the publisher/ protocol owner. Therefore the fees are "overcharged": because the fee amount is calculated on a pa...

Wrong implementation of performanceFee can cause users to lose 50% to 100% of their funds

Handle WatchPug Vulnerability details A certain amount of lp tokens shares of the vault will be minted to the strategyPerformanceTreasury as performanceFee, the amount is calculated based on the minLpPriceFactor. However, the current formula for toMint is wrong, which issues more than 100% of the...

The installation file of Kaspersky VPN Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, and Kaspersky Security Cloud is vulnerable, allowing a hacker to delete any file during the installation process.

The vulnerability of the installation files of antivirus protection software such as Kaspersky VPN Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, and Kaspersky Security Cloud lies in code errors. Exploiting this vulnerability could allow a hacker to delete any file duri...

The vulnerabilities of bdservicehost.exe and Vulnerability.Scan.exe of the Bitdefender Endpoint Security Tools for Windows (BEST) and the antivirus software Bitdefender Total Security allow attackers to enhance their privileges.

The vulnerability of the bdservicehost.exe and Vulnerability.Scan.exe processes of the Bitdefender Endpoint Security Tools for Windows BEST and the antivirus software Bitdefender Total Security systems is related to incorrect default access settings. Exploiting this vulnerability can allow...

The vulnerability of the McAfee Total Protection (MTP) antivirus protection system lies in its lack of access control mechanisms, allowing attackers to execute arbitrary codes or escalate their privileges.

The vulnerability of the McAfee Total Protection MTP antivirus protection system is related to deficiencies in access control. Exploiting this vulnerability allows an attacker to execute arbitrary code or increase their privileges...

MEV miner can mint larger than expected UDT total supply

Handle elprofesor Vulnerability details Impact UnlockProtocol attempts to calculate gas reimbursement using tx.gasprice, typically users who falsify tx.gasprice would lose gas to miners and therefore not obtain any advantage over the protocol itself. This does present capabilities for miners to...

Total Supply Does Not Change During the Burn/Mint

Handle defsec Vulnerability details Impact During the dynamic test, The Burn and Mint function does not increase/decrease total supply. That will cause liquidity loss on the protocol. Proof of Concept 1. Navigate to the following contracts. "" "" 2. Totalsupply is not adjusted according to...

ERC1155Supply vulnerability in OpenZeppelin Contracts

When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the ERC1155Supply extension, total supply is not updated until after the callback, thus during the callback the reported total supply is lower than the real number of...

GHSA-WMPV-C2JP-J2XG ERC1155Supply vulnerability in OpenZeppelin Contracts

When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the ERC1155Supply extension, total supply is not updated until after the callback, thus during the callback the reported total supply is lower than the real number of...

Kaspersky Total Security Directory Traversal Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Kaspersky Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...

VulnCheck KEV: CVE-2021-23874

McAfee Total Protection MTP contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense...

(0Day) Bitdefender Total Security Unnecessary Privileges Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Bitdefender Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

CVE-2021-3579

Incorrect Default Permissions vulnerability in the bdservicehost.exe and Vulnerability.Scan.exe components as used in Bitdefender Endpoint Security Tools for Windows, Total Security allows a local attacker to elevate privileges to NT AUTHORITY\SYSTEM This issue affects: Bitdefender Endpoint...

CVE-2021-3576

Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\System. Impersonation enables the server thread to perform actions on behalf of the client but within the limits of the client's security...