Two items having same number of votes above the quorum can lead to invariant violation and unfairness towards either of the item

Lines of code Vulnerability details Impact When an item is dropped or extracted from the maxHeap tree, it is directly done so from the item at the root of the tree i.e. index 0. Although this is expected, if one of the child itemIds have number of votes equal to that of the root node, this would ...

Malicious code in creators-landing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fc0499f838e1cfd0606c8ecd156259994c73c118b52297215ce9f135ca9028e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8455 Malicious code in creators-landing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fc0499f838e1cfd0606c8ecd156259994c73c118b52297215ce9f135ca9028e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PRBMATH SD59x18.exp() reverts on hugely negative numbers.

Lines of code Vulnerability details Impact ContinuousGDA.sol inherits a version of PRB Math that contains a vulnerability in the SD59x18.exp function, which can be reverted on hugely negative numbers. SD59x18.exp is used for calculations in ContinuousGDA.solpurchasePrice ,...

Design/Logic Flaw

Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute...

Snapchat: Delete anyone's content spotlight remotely.

A vulnerability was discovered in Snapchat's Spotlight feature that allowed anyone to delete another user's content remotely. By intercepting and modifying the delete request, an attacker could replace the ID parameter with that of another user's video, resulting in the deletion of their content...

GHSA-8R76-FR72-J32W Creator Verification Error when Bubblegum Activate

This was an error found by @metamania01 of the Audit Company Solshield. It allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with verified creators. The issue is now...

Ownership of EscherERC721.sol contracts can be changed, thus creator roles become useless

Lines of code Vulnerability details Impact creator = has a CREATORROLE in Escher.sol non-creator = doesn't have a CREATORROLE in Escher.sol Currently creating an ERC721 edition via the Escher721Factory.sol contract requires a user to have the CREATORROLE in the main Escher.sol contract. This...

The pledge creators might lose all of their funds by recoverERC20().

Lines of code Vulnerability details Impact There is a recoverERC20 function to withdraw ERC20 tokens from the contract. Currently, it checks if the token isn't an active reward token but it can be passed easily if the admin removes the reward token using removeRewardToken. So if the admin removes...

The pledge creators can't withdraw unused funds after the pledge is expired in the pause mode.

Lines of code Vulnerability details Impact Currently, the pledge creators can't do anything after the protocol is paused. So they can't withdraw their unused funds after the pledge is expired in the pause mode and the funds will be locked in the contract. Proof of Concept As we can see from...

Shopify: Cross-site scripting on api.collabs.shopify.com

Summary: Shopify collabs collabs.shopify.com is a new platform for content creators / influencers to discover and advertise the millions of brands of Shopify. The content creators can apply for different brands on this platform and get paid affiliate marketing. I discovered a cross-site scripting...

YTStealer targets YouTube content creators

Researchers are reporting the discovery of malware targeting YouTub content creators. The aim is to compromise accounts and then take over the victims channels completely. The malware, dubbed YTStealer, has one game plan: Grabbing authentication cookies. A site gives you an authentication cookie...

New YTStealer Malware Aims to Hijack Accounts of YouTube Content Creators

Cybersecurity researchers have documented a new information-stealing malware that targets YouTube content creators by plundering their authentication cookies. Dubbed "YTStealer" by Intezer, the malicious tool is likely believed to be sold as a service on the dark web, with it distributed using fa...

Moodle Improper Privilege Management

In Moodle 3.x, course creators are able to change system default settings for courses...

GHSA-JJHX-5JFF-RC8M Moodle Improper Privilege Management

In Moodle 3.x, course creators are able to change system default settings for courses...

Exchange does not split royalty revenue correctly

Lines of code Vulnerability details According to the README.md If royalty information was not defined when the NFT was originally deployed, it may be added using the Royalty Registry which will be respected by our market contract. The actual exchange code only respects the Royalty Registry or oth...

Google to turn on 2-factor authentication by default for 150 million users

Google has announced plans to automatically enroll about 150 million users into its two-factor authentication scheme by the end of the year as part of its ongoing efforts to prevent unauthorized access to accounts and improve security. In addition, the internet giant said it also intends to requi...

Deepfakes were going to change everything. And then they didn’t

For much of 2020, the most visible conversation about the US election and tech was related to deepfakes images or videos where the subject is replaced by another likeness. They could “destroy democracy” generally, and influence the US election in ways we couldn’t possibly imagine. People talked...

Remote Code Execution in Red Discord Bot

Impact A RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive...

creators.com Cross Site Scripting vulnerability OBB-1207272

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...