427 matches found
update_market() market weight incorrect
Lines of code Vulnerability details Vulnerability details in updatemarket We need to get the weight percentage of the corresponding market epoch through gaugeController Then allocate cantoPerBlockepoch according to the percentage The main logic code is as follows: function updatemarketaddress...
Input Validation for _vote Function
Lines of code Vulnerability details Potential Risk: The vote function in the CultureIndex contract takes two parameters: pieceId and voter. While the function includes some input validation checks, there are some potential issues and missing checks that should be addressed. Proof of Concept PoC:...
Slippage attack on claiming rewards
Lines of code Vulnerability details Impact Exploiter can abuse slippage to claim more weekly reward. The amount of slippage damage is unclear due to lack of deployment context and testing. Worst case scenario is the exploiter own 100% deposit of single pool allowing extreme slippage to steal enti...
_weight - voter.deductions can revert in underflow when counting the vote
Lines of code Vulnerability details Impact weight - voter.deductions can revert in underflow when counting the vote Proof of Concept In the current implementation, when a voting, the function countVote is triggered, this function is overriden in the function GovernorCountingOverridable.sol weight...
CVE-2023-37388 WordPress Simple Light Weight Social Share (Tweet, Like, Share and Linkedin) Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Sudipto Pratap Mahato Simple Light Weight Social Share plugin = 2.0 versions...
GaugeController` allows for quick vote and withdraw
Lines of code Vulnerability details This issue was identified in the original Curve Finance audit, finding ID TOB-CURVE-DAO-004. It remains unresolved in the mkt.market implementation, but was fixed in the Curve implementation. Impact A malicious voter is able to use full voting power for multipl...
GaugeController.sol isn't updated when voting power is delegated, enabling users to arbitrarily increase gauge weight
Lines of code Vulnerability details Impact A malicious user can arbitrarily increase any gauge's weight, resulting in loss of rewards for lenders of other gauges. Proof of Concept Note that the below code snippet from GaugeController.voteforgaugeweights called by users to cast and change votes...
GaugeController.remove_gauge() may indefinitely trap user voting power
Lines of code Vulnerability details Impact Users will permanently lose voting power equal to their power used to vote in the removed gauge unless the gauge is re-added and users re-vote to remove their voting power from the gauge. Proof of Concept GaugeController.sol does not have any function fo...
GaugeController allows for quick vote and withdraw voting strategy
Lines of code Vulnerability details Summary The GaugeController voting can be abused to apply all of the user's weight in every gauge's vote. GaugeController's voting changes the weight of the gauge. Each user can split their voting weight power between the gauges function...
Contrary to sponsor's intent, the gauge's weight will not be updated properly if governance do not change weight before any voting
Lines of code Vulnerability details Impact This is the intended procedure based on Sponsor's answer in discord: Q: when we add new gauge we don't set any weight point or any data for it, did the new gauge will get the weight and power by time when users vote for it ?! A: Yes, the idea is that the...
block.number DOES NOT PROVIDE A FAIR EVALUATION OF TIME MEASUREMENTS WITHIN FUNCTIONS
Lines of code Vulnerability details Impact The SecurityCouncilMemberElectionGovernorCountingUpgradeable.votesToWeight function is used to calculate the weight of a vote for a given proposal, block number, and number of votes. During the weight calculation the weight given for each vote depends on...
No slippage control while minting GLP
Lines of code Vulnerability details Impact glpRewardRouter.mintAndStakeGlpaddressweth, wethAmount, 0, 0; Here, minUSDG = 0 and minGlp = 0 means no slippage checks. This can be sandwitched in certain conditions in which delta between min and max glp price is higher due to following factors: delta...
WordPress Weight Based Shipping For WooCommerce Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)
Software Weight Based Shipping For WooCommerce Type Plugin Vulnerable versions = 1.3.2 Fixed in 1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 73b63a2ddc7e Credits Rafie Muhamm...
WordPress Cart Weight for WooCommerce Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)
Software Cart Weight for WooCommerce Type Plugin Vulnerable versions = 1.0.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 697cc226182a Credits Rafie Muhammad...
Bad accounting on ERC4626MultiToken.sol leads to user funds stuck in the contract
Lines of code Vulnerability details Summary Bad accounting on ERC4626MultiToken.sol leads to user funds stuck in the contract on deposit and withdraw logic. Vulnerability Detail The UlyssesToken unified liquidity tokens are derived from ERC4626Multitoken. This is an standard tokenized vault with...
WordPress Simple Light Weight Social Share (Tweet, Like, Share and Linkedin) Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Software Simple Light Weight Social Share Tweet, Like, Share and Linkedin Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-37388 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID...
PT-2023-17945 · Google · Android Kernel
Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds read in the FaceStatsAnalyzer::InterpolateWeightList function due to a missing bounds check. This could lead to local information disclosure with User execution...
CVE-2023-31672
In the PrestaShop 2.4.3 module "Length, weight or volume sell" ailinear there is a SQL injection vulnerability...
