Ethereum Lottery has a flawed logic vulnerability

Ethereum Lottery is an ethereum-based betting game.Ethereum Lottery's simplelottery smart contract implementation has a security vulnerability in the 'PayWinner' function that stems from the ' PayWinner' function uses the publicly readable variable maxTickets to generate random values. The...

Lucky9io has a logic flaw vulnerability

Lucky9io is an ethereum-based virtual gambling game.A security vulnerability exists in Lucky9io's implementation of a simple lotto smart contract, which stems from the use of a fallback function to generate random values using the publicly readable variable entrynumber. An attacker could exploit...

Security Bulletin: Publicly disclosed vulnerability found by vFinder in IBM eDiscovery Analyzer

Summary Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw when handling more than one Content-Length headers. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct...

ansible: Extract-Zip function in win_unzip module does not check extracted path

A flaw was found in the Ansible Engine when using the Extract-Zip function from the winunzip module as the extracted files are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path...

ansible: Extract-Zip function in win_unzip module does not check extracted path

A flaw was found in the Ansible Engine when using the Extract-Zip function from the winunzip module as the extracted files are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path...

Google Chrome Security Update (stable-channel-update-for-desktop_15-2020-04) - Windows

Google Chrome is prone to an use-after-free vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

Google Chrome Security Update (stable-channel-update-for-desktop_7-2020-04) - Windows

Google Chrome is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

DotNetNuke Cookie Deserialization Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' require 'openssl' require 'set' class MetasploitModule activetimeout payload handler is normally set up and started here but has be...

lucky88.win Cross Site Scripting vulnerability

Security Researcher 4NCURZE Helped patch 1379 vulnerabilities Received 7 Coordinated Disclosure badges Received 12 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting lucky88.win website and its users. Following coordinated a...

CVE-2020-6978

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries...

CVE-2020-6978

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries...

CVE-2020-6982

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution...

CVE-2020-6982

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution...

Design/Logic Flaw

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries...

Design/Logic Flaw

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution...

CVE-2020-7005

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely execute arbitrary code...

CVE-2020-7005

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely execute arbitrary code...

Cross site request forgery (csrf)

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely execute arbitrary code...

CVE-2020-6978

CVE-2020-6978 affects Honeywell WIN-PAK Web (and prior) versions, caused by using obsolete jQuery libraries. The Red Hat/NVD/CRON-derived records align on a Web front-end flaw enabling remote code execution under certain conditions, with CVSSv3 base score 7.2 (HIGH) and vector AV:N/AC:L/PR:N/UI:N...

CVE-2020-6978

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries...