Pulsar - Data Exfiltration And Covert Communication Tool

Pulsar is a tool for data exfiltration and covert communication that enable you to create a secure data transfer, a bizarre chat or a network tunnel through different protocols, for example you can receive data from tcp connection and resend it to real destination through DNS packets. Setting up...

Re-entrancy in wfCashERC4626.withdraw() can lead to more gains in assets

Lines of code Vulnerability details This is a corrected version of the previous submission and typo mistakes corrected. Impact The withdraw function in wfCashERC4626.sol can be re-entered at the point of redeemInternal. Assume asset tokens are sent to receiver after shares are burnt, and user...

CVE-2021-44582

A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL...

CVE-2021-44582

A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL...

CVE-2021-44582

A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL...

CVE-2021-44582

CVE-2021-44582 affects Sourcecodester Money Transfer Management System 1.0. A remote attacker can escalate privileges to Admin via any URL. Documents cite network-based, low-attack-complexity access with single authentication and high impact (confidentiality, integrity, availability) per CVSS v3....

CVE-2021-44582

A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL...

deposit through onERC1155Received can be locked by attackers, making the function useless

Lines of code Vulnerability details Impact Disable depositing through onERC1155Receive, potentially breaking all integrations using this function as entry point. Proof of concept An attacker can transfer another fCash position to the wrapper contract, which will trigger ERC1155Actions.transfer ⇒...

The vulnerability of the Lifecycle Management component of the Hyperion Infrastructure Technology management solution allows a perpetrator to gain read access to data and modify it.

The vulnerability of the Lifecycle Management component of the Hyperion Infrastructure Technology exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to read, modify, add, or delete data using the HTT...

Money Transfer Management System 安全漏洞

Money Transfer Management System is a remittance management system.An elevation of privilege vulnerability exists in Money Transfer Management System version 1.0. A remote attacker can exploit this vulnerability to gain elevated privileges to the Admin role via any URL...

Loss of tokens due to wrong burn function

Lines of code Vulnerability details Impact redeemToUnderlying is also affected by the issue I reported earlier which is described below. The redeem function calls burn which is inherited from IERC777Upgradeable contract whose action is to burn ERC20 tokens, thus there is no transfer or withdrawal...

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S) IMAP(S) POP3(S) and LDAP(S) (openldap only).

...

Design/Logic Flaw

ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer...

CVE-2022-31649

ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer...

Loss of underlying tokens due to ERC4626 non-compliance in withdraw function in wfCashERC4626.sol

Lines of code Vulnerability details Impact The withdraw function in wfCashERC4626 is missing the code that transfers the underlying tokens to the receiver. According to the EIP-4626 standard, withdraw function Burns shares from owner and sends exactly assets of underlying tokens to receiver...

PT-2022-20877 · Owncloud · Owncloud

Name of the Vulnerable Software and Affected Versions: ownCloud versions prior to 10.10.0 Description: The issue concerns the improper removal of sensitive information before storage or transfer. Recommendations: For versions prior to 10.10.0, update to version 10.10.0 or later to resolve the iss...

CVE-2022-29620

FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a vulnerability...

The vulnerability of the Data Transfer component in the Google Chrome browser allows attackers to disclose protected information.

The vulnerability of the Data Transfer component in Google Chrome exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information through a specially created web page...

PT-2022-6998 · Exim +4 · Exim +4

Name of the Vulnerable Software and Affected Versions: Exim versions prior to 4.97.1 Exim versions 4.94.2-7+deb11u1 through 4.96-15+deb12u2 Exim versions prior to 4.92-8+deb10u8 Exim versions prior to 4.96.1-1.1 Description: Exim is vulnerable to multiple issues, including a stack-based buffer...

Upgraded Q -> M from 119 [1654475092615]

Judge has assessed an item in Issue 119 as Medium risk. The relevant finding follows: Checking whether the receiver is capable of holding ERC721 The contract usessafeTransfer for ERC20 but uses transferFrom for ERC721 in both exercise and withdraw which may lead to the loss of ERC721 if the...