370 matches found
CVE-2021-39218
Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger thi...
YAxisVotePower.balanceOf can be manipulated
Handle cmichel Vulnerability details The YAxisVotePower.balanceOf contract uses the Uniswap pool reserves to compute a lpStakingYax reward: uint256 yaxReserves,, = yaxisEthUniswapV2Pair.getReserves; int256 lpStakingYax = yaxReserves .mulstakeAmount .divsupply .addrewardsYaxisEth.earnedvoter; The...
What Apple Can Do Next to Fight Child Sexual Abuse
The fallout from the company's recent proposal has created a new opportunity to fix how it roots out abusive material across its devices...
Possible to deny proposal creations
Handle cmichel Vulnerability details There can only ever be one active proposal. An attacker could front-run a proposal creation by submitting a dummy proposal. The original proposal creation would fail. Impact The cost of the attack is the proposal fees. There can be an incentive to deny the...
You can vote for proposal already completed
Handle s1m0 Vulnerability details Impact The mapPIDfinalised is set on completeProposal but voteProposal doesn't check it. A malicious user with enough capital and/or together with other people could execute a proposal in his favor e.g. a grant infinitely. Proof of Concept 1 newGrantProposal 2...
A proposal can be cancelled by anyone
Handle s1m0 Vulnerability details Impact A proposal can be cancelled by anyone if only exist another proposal with the same type and hasMinority has 16% votes. Proof of Concept 1 voteProposal assume this vote trigger finalise. finalise set mapPIDfinalisingproposalID = true 2 cancelProposal This...
Overview of the EU’s draft NIS 2 Directive
Anticipating stronger security requirements for critical EU sectors A pdf copy of this brief is available here. The EU Commission recently proposed a revision to its Directive on Security of Network and Information Systems NIS. The existing NIS Directive “NIS 1” requires EU Member States to enact...
technicalproposaltemplate.com Cross Site Scripting vulnerability OBB-1316049
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Fedora 32 : mingw-podofo / podofo (2020-2d80e03190)
This update applies a proposed fix for CVE-2018-12983. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...
A US Data Protection Agency
The United States is one of the few democracies without some formal data protection agency, and we need one. Senator Gillibrand just proposed creating one...
U.S. Dept Of Defense: Unprotected ██████ and Test site API Exposes Documents, Credentials, and Emails in ██████████ Proposal System
Summary: The test/integration API of the █████ web services is publicly exposed: disclosing documents, emails, and credentials to what appears to be the Seaport Bid proposal system. Because I did not attempt any exploitation outside of that necessary to deem this a reportable issue, it is not cle...
ACCESS Act might improve data privacy through interoperability
Data privacy is back in Congressional lawmakers’ sights, as a new, legislative proposal focuses not on data collection, storage, and selling, but on the idea that Americans should be able to more easily pack up their user data and take it to a competing service—perhaps one that better respects...
ACLU on the GCHQ Backdoor Proposal
Back in January, two senior GCHQ officials proposed a specific backdoor for communications systems. It was universally derided as unworkable -- by me, as well. Now Jon Callas of the ACLU explains why...
GigToDo 1.3 - Cross-Site Scripting
GigToDo 1.3 - Cross-Site Scripting Exploit Title: GigToDo - Freelance Marketplace Script v1.3 Persistent XSS Injection Google Dork: - Date: 2019/07/28 Author: m0ze Vendor Homepage: https://www.gigtodoscript.com Software Link: https://codecanyon.net/item/gigtodo-freelance-marketplace-script/238553...
This Week in Security News: Phishing Attacks and Ransomware
Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about schemes used in phishing and other email-based attacks. Also, learn how ransomware continues to make a significant impact in the...
Facebook’s history betrays its privacy pivot
Facebook CEO Mark Zuckerberg proposed a radical pivot for his company this month: it would start caring—really—about privacy, building out a new version of the platform that turns Facebook less into a public, open “town square” and more into a private, intimate “living room.” Zuckerberg promised...
Federal Focus on Cyber Plays Out in President's Budget, IoT Legislation
The federal government is stepping up its game this week on the cybersecurity front, with both proposed budget line items that would requisition nearly $11 billion for cyber, and the introduction of the Internet of Things IoT Cybersecurity Improvement Act of 2019, which would require that devices...
Hacking the GCHQ Backdoor
Last week, I evaluated the security of a recent GCHQ backdoor proposal for communications systems. Furthering the debate, Nate Cardozo and Seth Schoen of EFF explain how this sort of backdoor can be detected: In fact, we think when the ghost feature is active -- silently inserting a secret...
E.U.: Tech Giants Face Big Fines, 1 Hour Limit to Remove Extremist Content
As the E.U. continues to develop tactics to better combat terrorism, European authorities plan to propose strict rules about content policing by tech giants such as Google, Twitter and Facebook. European Commission President Jean-Claude Juncker said Wednesday that the proposed rules would specify...
BIP proposal security bypass vulnerability
The BIP proposal is a set of bitcoin verification algorithms. A security bypass vulnerability exists in the 'Bitcoin proof of work' function in BIP proposal. A remote attacker could use this vulnerability to bypass security restrictions and perform unauthorized operations...