148 matches found
WordPress LiquidPoll β Advanced Polls for Creators and Brands Plugin <= 3.3.76 is vulnerable to Sensitive Data Exposure
Software LiquidPoll β Advanced Polls for Creators and Brands Type Plugin Vulnerable versions = 3.3.76 Fixed in 3.3.77 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2080 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...
Plv8 Code Issues Vulnerabilities
Plv8 is a shared library that provides the PostgreSQL procedural language supported by the V8 Javascript engine. A security vulnerability exists in Plv8 version 3.2.1, which originates from the ability of a user who creates objects in the database to execute delayed triggers as a superuser during...
Google Is Getting Thousands of Deepfake Porn Complaints
Content creators are using copyright laws to get nonconsensual deepfakes removed from the web. With the complaints covering nearly 30,000 URLs, experts say Google should do more to help...
CultureIndex.sol#_vote() - Creators of certain piece can vote for their piece
Lines of code Vulnerability details Impact In CultureIndex there is a function vote that allows users to vote for a piece to get sold on the auction house. Each piece has creators that get cut of the sale. The problem is that there is no checks if the user voting for a certain piece is it's own...
Two items having same number of votes above the quorum can lead to invariant violation and unfairness towards either of the item
Lines of code Vulnerability details Impact When an item is dropped or extracted from the maxHeap tree, it is directly done so from the item at the root of the tree i.e. index 0. Although this is expected, if one of the child itemIds have number of votes equal to that of the root node, this would ...
Incomplete Creator Rewards in Auction Settlement
Lines of code Vulnerability details Summary During the settlement of auctions in the AuctionHouse, the proceeds meant for creators are not accurately distributed, leading to potential loss of funds for the creators. Vulnerability Details In the process of settling auctions...
Malicious code in creators-landing (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fc0499f838e1cfd0606c8ecd156259994c73c118b52297215ce9f135ca9028e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8455 Malicious code in creators-landing (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fc0499f838e1cfd0606c8ecd156259994c73c118b52297215ce9f135ca9028e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PRBMATH SD59x18.exp() reverts on hugely negative numbers.
Lines of code Vulnerability details Impact ContinuousGDA.sol inherits a version of PRB Math that contains a vulnerability in the SD59x18.exp function, which can be reverted on hugely negative numbers. SD59x18.exp is used for calculations in ContinuousGDA.solpurchasePrice ,...
Design/Logic Flaw
Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute...
Snapchat: Delete anyone's content spotlight remotely.
A vulnerability was discovered in Snapchat's Spotlight feature that allowed anyone to delete another user's content remotely. By intercepting and modifying the delete request, an attacker could replace the ID parameter with that of another user's video, resulting in the deletion of their content...
GHSA-8R76-FR72-J32W Creator Verification Error when Bubblegum Activate
This was an error found by @metamania01 of the Audit Company Solshield. It allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with verified creators. The issue is now...
Ownership of EscherERC721.sol contracts can be changed, thus creator roles become useless
Lines of code Vulnerability details Impact creator = has a CREATORROLE in Escher.sol non-creator = doesn't have a CREATORROLE in Escher.sol Currently creating an ERC721 edition via the Escher721Factory.sol contract requires a user to have the CREATORROLE in the main Escher.sol contract. This...
The pledge creators might lose all of their funds by recoverERC20().
Lines of code Vulnerability details Impact There is a recoverERC20 function to withdraw ERC20 tokens from the contract. Currently, it checks if the token isn't an active reward token but it can be passed easily if the admin removes the reward token using removeRewardToken. So if the admin removes...
The pledge creators can't withdraw unused funds after the pledge is expired in the pause mode.
Lines of code Vulnerability details Impact Currently, the pledge creators can't do anything after the protocol is paused. So they can't withdraw their unused funds after the pledge is expired in the pause mode and the funds will be locked in the contract. Proof of Concept As we can see from...
Shopify: Cross-site scripting on api.collabs.shopify.com
Summary: Shopify collabs collabs.shopify.com is a new platform for content creators / influencers to discover and advertise the millions of brands of Shopify. The content creators can apply for different brands on this platform and get paid affiliate marketing. I discovered a cross-site scripting...
YTStealer targets YouTube content creators
Researchers are reporting the discovery of malware targeting YouTub content creators. The aim is to compromise accounts and then take over the victims channels completely. The malware, dubbed YTStealer, has one game plan: Grabbing authentication cookies. A site gives you an authentication cookie...
New YTStealer Malware Aims to Hijack Accounts of YouTube Content Creators
Cybersecurity researchers have documented a new information-stealing malware that targets YouTube content creators by plundering their authentication cookies. Dubbed "YTStealer" by Intezer, the malicious tool is likely believed to be sold as a service on the dark web, with it distributed using fa...
