399 matches found
CVE-2021-24435
The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues...
Cross site scripting
The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues...
CVE-2021-24435
The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues...
Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)
Description The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues Edit WPScanTeam: - The original report mentioned the issue...
Improper access control of claimAllForMember allows anyone to reduce the weight of a member
Handle shw Vulnerability details Impact The claimAllForMember function of Dao is permissionless, allowing anyone to claim the unlocked bonded LP tokens for any member. However, claiming a member's LP tokens could decrease the member's weight in the BondVault, thus affecting the member's votes and...
SynthVault deposit lockup bypass
Handle cmichel Vulnerability details Vulnerability Details The SynthVault.harvestSingle function can be used to mint & deposit synths without using a lockup. An attacker sends BASE tokens to the pool and then calls harvestSingle. The inner iPOOLpoolOUT.mintSynthsynth, addressthis; call will mint...
Ransomware. In the air?
Introduction As an exercise, we were asked to look at the potential vectors for ransomware to affect flight despatch and operations. In most cases, flight systems simply werent significantly exposed, but ground systems affected by ransomware may make flight ops either impossible or significantly...
Vault rewards can be gamed
Handle @cmichelio Vulnerability details Vulnerability Details The deposit function increases the member's weight by weight = iUTILSUTILS.calcValueInBaseiSYNTHsynth.TOKEN, amount; which is the swap output amount when trading the deposited underlying synth amount. Notice that anyone can create synt...
Vault Weight accounting is wrong for withdrawals
Handle @cmichelio Vulnerability details Vulnerability Details When depositing two different synths, their weight is added to the same mapMemberweightmember storage variable. When withdrawing the full amount of one synth with processWithdrawsynth, member, basisPoints=10000 the full weight is...
Heap buffer overflow in Tensorflow
Impact The SparseCountSparseOutput and RaggedCountSparseOutput implementations don't validate that the weights tensor has the same shape as the data. The check exists for DenseCountSparseOutput, where both tensors are fully specified:...
weight-calendar.com Cross Site Scripting vulnerability OBB-1320158
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Fedora: Security Advisory for lua (FEDORA-2020-c83556709c)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Metrics That Matter: Continuous Performance Optimization
To attract and retain customers, you must offer an exceptional digital experience. In an increasingly competitive business climate, organizations are fighting to maintain loyalty and keep users engaged online. The cost of switching is low, consumers are transient, and user expectations for how...
ideal-weight-table-template.com Cross Site Scripting vulnerability OBB-1290352
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
[SECURITY] Fedora 32 Update: swt-chart-0.12.0-3.fc32
SWTChart is a light-weight charting component for SWT...
Moderate: lua security and bug fix update
The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Security Fixes: lua: use-after-free in luaupvaluejoin in lapi.c resulting in denial of service...
GitLab EE Authorization Issues Vulnerability (CNVD-2019-42743)
GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. GitLab EE...
CVE-2018-19581
Removed by vendor...
