Threat Intelligence Database

A vulnerability exists in WonderTrader up to version 0.9.9 affecting the TraderDD::queryTrades function. The issue involves manipulation of the argument FID_JYLB, which can enforce behavioral workflow changes. The attack can be performed remotely but requires high complexity and is difficult to exploit. The vendor has not responded to disclosure, and no patch or fix information is available. The vulnerability has a low CVSS score of 3.7 and no known exploits in the wild.

A vulnerability exists in WonderTrader up to version 0.9.9 in the Pending Order Handler component, specifically in the _undone_qty function. The issue involves manipulation of the getUndoneQty argument, which can enforce unintended behavioral workflow. The vulnerability can be exploited remotely. Public exploit code is available. The vendor has not responded to disclosure requests. The CVSS score is 4.3, indicating a low severity impact.

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument m_offsetType can lead to use of uninitialized variable. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the argument FID_JYLB results in enforcement of behavioral workflow. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update_lob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.