The fork escrow voting should use the snapshot mechanism to save whether the current DAO state reaches the fork threshold

Lines of code Vulnerability details Impact The fork escrow vote does not use the snapshot mechanism or checkpoint mechanism to save whether the current DAO state reaches the fork threshold, which may cause the timing of the fork to be missed. Proof of Concept Suppose the following scenario: 1. Wh...

The fork mechanism of Nouns DAO may be completely ineffective or abused, because there is no reasonable limit to the maximum or minimum value of the fork threshold.

Lines of code Vulnerability details Impact Nouns Fork is a Last-Resort Minority Protection Mechanism, created to protect the minority from the tyranny of the majority. As described in this article: . In the initial case, if a quorum of 20% of tokens signals to exit, the fork will succeed, but sin...

The fork mechanism of Nouns lacks a fork cooling-off period/clarification period/remedial period mechanism, which cannot resist someone maliciously inciting the emotions of DAO members and triggering impulsive forks

Lines of code Vulnerability details Impact It's important that forking happen rarely. Once a fork occurs, it cannot be canceled. It is not a good thing for DAO to happen. It is necessary to ensure that DAO members propose a fork after calm deliberation. The current Nouns forking mechanism lacks a...

CVE-2023-34601

Jeesite before commit 10742d3 was discovered to contain a SQL injection vulnerability via the component $businessTable at /act/ActDao.xml...

CVE-2023-34101

Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the daoinputstoring function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 bytes...

Out-of-bounds

Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the daoinputstoring function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 bytes...

CVE-2023-34101 Contiki-NG vulnerable to out-of-bounds read when processing ICMP DAO input

Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the daoinputstoring function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 bytes...

CVE-2023-34101 Contiki-NG vulnerable to out-of-bounds read when processing ICMP DAO input

Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the daoinputstoring function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 bytes...

PrinterLogic Build 1.0.757 XSS / SQL Injection / Authentication Bypass

PrinterLogic SaaS, multiple vulnerabilities =========================================================== PrinterLogic's Enterprise Print Management software allows IT professionals to simplify printer driver management and empower end users. -- https://www.printerlogic.com/ Background...

Upgraded Q -> 3 from #883 [1682591277339]

Judge has assessed an item in Issue 883 as 3 risk. The relevant finding follows: As such, if deposit or withdraw reverts for any derivative, stake and unstake will fail. This could cause stake and unstake to permanently revert for an prolonged period of time, as it is possible for deposit and...

A malicious frontrunner can make the Mutebond contract broken when the owner decreases maxPayout

Lines of code Vulnerability details Impact The Mutebond contract might stop working after the owner decreased maxPayout by a malicious frontrunner. Proof of Concept setMaxPayout can be used to reset maxPayout. function setMaxPayoutuint payout external requiremsg.sender == customTreasury.owner;...

CVE-2022-36979

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

Ivanti Avalanche SQL注入漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. Ivanti Avalanche version 6.3.2.3490 suffers from a SQL injection vulnerability that stems from a crafted request in...

Input validation

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in...

CVE-2023-28108

Pimcore before 10.5.19 has improper quoting in the UUID DAO model, creating a theoretical SQL injection risk if input data is not validated and relies on auto-quoting. The vulnerability affects the UUID-related methods in the DAO layer and is mitigated by upgrading to version 10.5.19 or applying ...

CVE-2023-28108 Pimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in...

NeoTokyoStaker.getPoolReward function can be frontrun, which can cause staker and DAO to lose reward shares that they are entitled to

Lines of code Vulnerability details Impact When calling the following NeoTokyoStaker.stakeBytes and NeoTokyoStaker.stakeLP functions, the higher the specified amount to be staked is, the higher the pool.totalPoints is increased by. function stakeBytes uint256 private uint256 amount; uint256...

Funds in DAO contract cannot be withdrawn

Lines of code Vulnerability details Impact The DAO contract can receive funds but can not withdraw, Funds occasionally sent by users will be stuck in those contracts. Proof of Concept Receive funds through deposit function in DAO.solL218-L236 /// @inheritdoc IDAO function deposit address token,...

Locked Ether

Lines of code Vulnerability details Impact Contract with a payable function, but without a withdrawal capacity. Proof of Concept File: packages/contracts/src/core/dao/DAO.sol 233: external payable override 284: receive external payable Every Ether sent to DAO.sol will be lost. Tools Used VS Code...

Not having enough ETH may cause the transaction to fail

Lines of code Vulnerability details Impact The transaction will fail due to not having enough ETH. Proof of Concept When the proposal is executed, the protocol will call the function DAO.execute.The DAO protocol also supports sending ETH to external contract as the following code. bool success,...