Debian dla-3624 : libzookeeper-java - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3624 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3624-1 [email protected] https://www.debian.org/lts/security/...

CVE-2023-44981

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper quorum.auth.enableSasl=true, the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The...

CVE-2023-44981

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper quorum.auth.enableSasl=true, the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The...

CVE-2023-4309

Election Services Co. ESC Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused...

Sql injection

Election Services Co. ESC Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused...

CVE-2023-4309

Election Services Co. ESC Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused...

CVE-2023-4309

CVE-2023-4309 affects Election Services Co. (ESC) Internet Election Service. Multiple pages/parameters are vulnerable to SQL injection, allowing an unauthenticated, remote attacker to read or modify data for any elections sharing the same backend database. The public documentation consistently no...

CVE-2023-4309

Election Services Co. ESC Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused...

Election Services SQL Injection Vulnerability

Election Services is an application from Election Services, Inc. Election Services Internet Election Service suffers from a security vulnerability that stems from susceptibility to SQL injection attacks, allowing an unauthenticated, remote attacker to read or modify data for any election that...

PT-2023-28694 · Election Services Co. · Internet Election Service

Name of the Vulnerable Software and Affected Versions: Election Services Co. ESC Internet Election Service affected versions not specified Description: The issue concerns SQL injection vulnerabilities in multiple pages and parameters of the Election Services Co. ESC Internet Election Service. The...

Deepfake Election Interference in Slovakia

Well designed and well timed deepfake or two Slovakian politicians discussing how to rig the election: Šimečka and Denník N immediately denounced the audio as fake. The fact-checking department of news agency AFP said the audio showed signs of being manipulated using AI. But the recording was...

Political Disinformation and AI

Elections around the world are facing an evolving threat from foreign actors, one that involves artificial intelligence. Countries trying to influence each others elections entered a new era in 2016, when the Russians launched a series of social media disinformation campaigns targeting the US...

This Week in Spring - October 3rd, 2023

Hi Spring fans! Welcome to another installment of This Week in Spring! How're you doin'? I've just flown in from Singapore - where I was keynoting and presenting at SpringOne Singapore - and am now in Antwerp, Belgium for the deliriously fun Devoxx Belgium show. I've missed this show, and it's a...

How Cyberattacks Are Transforming Warfare

There is a new battlefield. It is global and challenging to defend. What began with a high-profile incident back in 2007, when Estonia was hit by hackers targeting its government and commercial sector, has evolved into cyber warfare that is being waged constantly worldwide. Today, cyberattacks ha...

Reusing other user's votes for both nominee and member elections

Lines of code Vulnerability details Impact The two elections nominee and member are sharing the same proposal id. This give an attack opportunity to a malicious user to reuse signature of other users who casted vote by signature in nominee election for casting vote in member election. In other...

Invalid startDate check in SecurityCouncilNomineeElectionGovernorTiming contract

Lines of code Vulnerability details Summary The SecurityCouncilNomineeElectionGovernorTiming contract has an invalid startDate check in the SecurityCouncilNomineeElectionGovernorTiminginit function. The check ensures that the startDate is in the future, but it does not check that the startDate is...

Signatures can be replayed in castVoteWithReasonAndParamsBySig() to use up more votes than a user intended

Lines of code Vulnerability details Bug Description In the SecurityCouncilNomineeElectionGovernor and SecurityCouncilMemberElectionGovernor contracts, users can provide a signature to allow someone else to vote on their behalf using the castVoteWithReasonAndParamsBySig function, which is in...

Stealing or reusing votes

Lines of code Vulnerability details Impact It is possible to reuse/steal user's votes if they are supposed to cast vote by signature. Proof of Concept Casting votes during nominee election and member election is possible by calling the functions: castVoteWithReasonAndParams...

setFullWeightDuration() can be called while a member election is ongoing

Lines of code Vulnerability details Bug Description In SecurityCouncilMemberElectionGovernorCountingUpgradeable, fullWeightDuration which is the duration where a user's votes has weight 1 can be set using setFullWeightDuration: SecurityCouncilMemberElectionGovernorCountingUpgradeable.solL77-L84...

The Owner of SecurityCouncilMemberElectionGovernor Can Replace Cohorts And Bypass The Election Process

Lines of code Vulnerability details Impact In SecurityCouncilManager contract: the cohorts members are replaced by election via replaceCohort function; the process goes as follows: 1. an election proposal is made by anyone after 6-months of the last election via...