CVE-2022-25222

Summary: CVE-2022-25222 affects Money Transfer Management System v1.0. An unauthenticated attacker can inject SQL via the id parameter in two admin pages (admin/maintenance/manage_branch.php and admin/maintenance/manage_fee.php). Root cause: Missing validation of external input used in SQL statem...

CVE-2022-25221

The CVE-2022-25221 entry concerns Money Transfer Management System v1.0, where an attacker can inject JavaScript code via a URL and persuade a user to visit that link to execute the script. Root cause cited across sources is lack of input validation/filtering and output handling for user-supplied...

CVE-2022-25221

Money Transfer Management System Version 1.0 allows an attacker to inject JavaScript code in the URL and then trick a user into visit the link in order to execute JavaScript code...

Money Transfer Management System 跨站脚本漏洞

A cross-site scripting vulnerability exists in Money Transfer Management System version 1.0, a money transfer management system. The vulnerability stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to execute...

Fedora: Security Advisory for containerd (FEDORA-2022-230f2b024b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Money Transfer Management System SQL注入漏洞

Money Transfer Management System is a remittance management system. version 1.0 of Money Transfer Management System is vulnerable to SQL injection, which stems from a lack of validation of external input SQL statements in the id parameter of mtms/admin/?page=transaction/viewdetails. An attacker...

Money Transfer Management System SQL注入漏洞

A SQL injection vulnerability exists in Money Transfer Management System version 1.0, a money transfer management system. The vulnerability stems from missing validation of external input SQL statements in the id parameter in admin/maintenance/managebranch.php and admin/maintenance/managefee.php...

[SECURITY] Fedora 35 Update: containerd-1.6.1-1.fc35

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

[SECURITY] Fedora 34 Update: containerd-1.6.1-1.fc34

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

Malicious User can Manipulate PreCT Mint Logic with Direct Base Token Transfer

Lines of code Vulnerability details Impact A bad actor can steal funds from future depositors by sending the base token directly to the Strategy or StrategyController contracts. This exploit is more effective the less shares that have already been distributed, perhaps early into the launch of the...

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker who controls the HTTP server to make the client script enter an infinite loop consuming CPU time. The highest threat from this vulnerability is to system availability.

...

Fee-on-transfer/deflationary tokens cause problems

Lines of code Vulnerability details Some ERC20 tokens, such as USDT, allow for charging a fee any time transfer or transferFrom is called. If a contract does not allow for amounts to change after transfers, subsequent transfer operations based on the original amount will revert due to the contrac...

The vulnerability of the Oracle Access Manager component of the Oracle Fusion Middleware software allows a perpetrator to execute arbitrary code.

The vulnerability of the Oracle Access Manager component of the Oracle Fusion Middleware software is related to errors in processing http requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ALPINE-CVE-2022-22720

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling...

bETH rewards can be timed

Lines of code Vulnerability details Impact The bETH reward contract allocates new rewards sent to the contract whenever updateglobalindex is called. It should be possible to time the transfer of the rewards to the contract and frontrun it with increasing one's token balance to capture more reward...

Missing allowlist checks on tokens in CrossAnchorBridge could cause loss of funds

Lines of code Vulnerability details Impact The CrossAnchorBridge contract accepts any ERC20 token and transfers them to the wormhole bridge. There were allowlist checks on the tokens before, but they were commented out in this version for the audit. If a user transfers, for example, non-supported...

Inconsistency behavior between bAsset tokens and the standard cw20 tokens

Lines of code Vulnerability details Impact The implementation of the send function of bAsset tokens is inconsistent with the standard cw20's implementation. In the standard implementation, the msg and the transfer amount are passed to the recipient contract as a regular message. However, in the...

Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding

Summary: The llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS. Description: When Node receives the following request: http GET / HTTP/1.1 Transfer-Encoding: chunked , identity 1 a 0 it...

Conti Ransomware Group Diaries, Part III: Weaponry

Part I of this series examined newly-leaked internal chats from the Conti ransomware group, and how the crime gang dealt with its own internal breaches. Part II explored what its like to be an employee of Contis sprawling organization. Todays Part III looks at how Conti abused popular commercial...

The vulnerability of the web interface of NETGEAR RAX43 integrated software routers allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the web interface of NETGEAR RAX43 router software relates to the transmission of data in an open manner. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information through HTTP requests...