CVE-2022-32559

An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics...

CVE-2022-27219

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. Affected application is missing general HTTP security headers in the web server configured on port 443. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks a...

CVE-2021-30338

Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Compute...

Input validation

Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Compute...

Approve Returned Value Not Validated

Lines of code Vulnerability details Proof-of-Concept The approve function attempts to performs an ERC20.approve call, but does not check if the returned value is true Succeed or false Failed. Some tokens do not revert if the approval failed but return false instead. / @dev Approve the given...

wfCashERC4626.sol#redeem() Lack of slippage control for market sell

Lines of code Vulnerability details function redeem uint256 shares, address receiver, address owner public override returns uint256 // It is more accurate and gas efficient to check the balance of the // receiver here than rely on the previewRedeem method. uint256 balanceBefore =...

User can alter amount returned by redeem function due to control transfer

Lines of code Vulnerability details Impact Control is transferred to the receiver when receiving the ERC777. They are able to transfer the ERC777 to another account, at which time the before and after balance calculation will be incorrect. uint256 balanceBefore = IERC20asset.balanceOfreceiver; if...

Upgraded Q -> M from 182 [1655245716777]

Judge has assessed an item in Issue 182 as Medium risk. The relevant finding follows: L-Can send ETH more than buyOption premium required Link. requiremsg.value = premium should be requiremsg.value == premium to prevent user send too much eth. Only beneficiary benefit from this. Contract should...

CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

Pulsar - Data Exfiltration And Covert Communication Tool

Pulsar is a tool for data exfiltration and covert communication that enable you to create a secure data transfer, a bizarre chat or a network tunnel through different protocols, for example you can receive data from tcp connection and resend it to real destination through DNS packets. Setting up...

Re-entrancy in wfCashERC4626.withdraw() can lead to more gains in assets

Lines of code Vulnerability details This is a corrected version of the previous submission and typo mistakes corrected. Impact The withdraw function in wfCashERC4626.sol can be re-entered at the point of redeemInternal. Assume asset tokens are sent to receiver after shares are burnt, and user...

CVE-2021-44582

A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL...

CVE-2021-44582

A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL...

CVE-2021-44582

A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL...

CVE-2021-44582

A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL...

CVE-2021-44582

CVE-2021-44582 affects Sourcecodester Money Transfer Management System 1.0. A remote attacker can escalate privileges to Admin via any URL. Documents cite network-based, low-attack-complexity access with single authentication and high impact (confidentiality, integrity, availability) per CVSS v3....

deposit through onERC1155Received can be locked by attackers, making the function useless

Lines of code Vulnerability details Impact Disable depositing through onERC1155Receive, potentially breaking all integrations using this function as entry point. Proof of concept An attacker can transfer another fCash position to the wrapper contract, which will trigger ERC1155Actions.transfer ⇒...

Money Transfer Management System 安全漏洞

Money Transfer Management System is a remittance management system.An elevation of privilege vulnerability exists in Money Transfer Management System version 1.0. A remote attacker can exploit this vulnerability to gain elevated privileges to the Admin role via any URL...

The vulnerability of the Lifecycle Management component of the Hyperion Infrastructure Technology management solution allows a perpetrator to gain read access to data and modify it.

The vulnerability of the Lifecycle Management component of the Hyperion Infrastructure Technology exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to read, modify, add, or delete data using the HTT...

Loss of tokens due to wrong burn function

Lines of code Vulnerability details Impact redeemToUnderlying is also affected by the issue I reported earlier which is described below. The redeem function calls burn which is inherited from IERC777Upgradeable contract whose action is to burn ERC20 tokens, thus there is no transfer or withdrawal...