Malicious user can prevent the creation of a proposal

Lines of code Vulnerability details Vulnerability Detail The LivepeerGovernor inherits OpenZeppelin's GovernorUpgradeable contract. The GovernorUpgradeable utilizes the hashProposal function to generate a unique hash when creating a new proposal. The hash depends solely on input parameters:...

Vulnerability in the increaseTotalStake() call happening before deleting the lock in the processRebond() function.

Lines of code Vulnerability details Impact This can allow double claiming of stake if the user tries to rebond again with the same lock ID. Proof of Concept The main points: • del.bondedAmount is increased before the lock is deleted • increaseTotalStake is called after deleting the lock If...

Inaccurate Bonded Amount Event Emission

Lines of code Vulnerability details Impact in here : if previous.bondedAmount != current.bondedAmount emit DelegatorBondedAmountChangedaccount, previous.bondedAmount, current.bondedAmount; the function checks if the previous.bondedAmount is not equal to current.bondedAmount before emitting the...

WordPress Media Library Assistant Plugin <= 3.09 is vulnerable to Remote Code Execution (RCE)

Software Media Library Assistant Type Plugin Vulnerable versions = 3.09 Fixed in 3.10 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-4634 Patch priority High CVSS severity High 10 Developer Claim ownership PSID a9f84b644a17 Credits Pepitoh Required privilege...

CVE-2023-41317

The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service DoS type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are...

Design/Logic Flaw

The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service DoS type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are...

CVE-2023-41317

Summary. CVE-2023-41317 affects Apollo Router (Rust) v1.28.0, v1.28.1, and v1.29.0, where an anonymous GraphQL subscription can trigger a DoS panic if the supergraph defines a subscription type and subscriptions are enabled in config. The vulnerability requires all four conditions to be met: impa...

CVE-2023-41317 Unnamed "Subscription" operation results in Denial-of-Service in apollographql/router

The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service DoS type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are...

CVE-2023-41317 Unnamed "Subscription" operation results in Denial-of-Service in apollographql/router

The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service DoS type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are...

onoranzechristiandecarlo.it Cross Site Scripting vulnerability OBB-3649863

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-27954

A vulnerability was found in WebKitGTK. This security issue leads to tracking sensitive user information via a website. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and...

CVE-2023-27932

A vulnerability was found in WebKitGTK. This security issue occurs when processing maliciously crafted web content that may bypass the same-origin Policy. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criter...

Open Automation Software OAS Platform OAS Engine configuration management information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1775 Open Automation Software OAS Platform OAS Engine configuration management information disclosure vulnerability September 5, 2023 CVE Number CVE-2023-35124 SUMMARY An information disclosure vulnerability exists in the OAS Engine configuration management...

WordPress Stagtools Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)

Software Stagtools Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-41868 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3bb564ac29eb Credits Le Ngoc Anh Required privilege...

WordPress Click To Tweet Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS)

Software Click To Tweet Type Plugin Vulnerable versions = 2.0.14 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41856 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a4c8c362a5de Credits thiennv Required...

Open Automation Software OAS Platform OAS Engine authentication bypass vulnerability

Talos Vulnerability Report TALOS-2023-1770 Open Automation Software OAS Platform OAS Engine authentication bypass vulnerability September 5, 2023 CVE Number CVE-2023-34998 SUMMARY An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platfor...

CVE-2023-41054

LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side Request Forgery SSRF vulnerability in the imageproxy.php file of LibreY before commit 8f9b9803f231e2954e5b49987a532d28fe50a627. This vulnerability allows remo...

Exploit for Use of a Broken or Risky Cryptographic Algorithm in Vmware Aria_Operations_For_Networks

CVE-2023-34039 POC for CVE-2023-34039 VMWare Aria Operations f...

PT-2023-27316 · Devaldi · Flowpaper Plugin

Name of the Vulnerable Software and Affected Versions: Devaldi Ltd flowpaper plugin versions = 1.9.9 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Devaldi Ltd flowpaper plugin. This vulnerability requires authentication and is limited to use...

edeportes.aytosalamanca.es Cross Site Scripting vulnerability OBB-3641096

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...