119 matches found
Incorrect Creation Of Governance Proposals
@openzeppelin/contracts performs incorrect creation of governance proposals. Using bad ABI encoding in GovernorCompatibilityBravo with explicit function signatures along with calldata results in incorrect creation of governance proposals with incorrect arguments...
GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior
Impact The GovernorCompatibilityBravo module may lead to the creation of governance proposals that execute function calls with incorrect arguments due to bad ABI encoding. This happens if the proposal is created using explicit function signatures, e.g. a proposal to invoke the function foouint256...
GHSA-M6W8-FQ7V-PH4M GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior
Impact The GovernorCompatibilityBravo module may lead to the creation of governance proposals that execute function calls with incorrect arguments due to bad ABI encoding. This happens if the proposal is created using explicit function signatures, e.g. a proposal to invoke the function foouint256...
Possible DoS attack in creating new DAO proposals
Handle shw Vulnerability details Impact The functions of creating new DAO proposals e.g., newActionProposal are permissionless. Anyone can create a new proposal by paying some fees in SPARTA, as long as the previous proposal is closed. Thus, an attacker could then front-run proposals of benign...
Vote removals for critical proposal types are not re-checked for hasMajority at execution
Handle 0xRajeev Vulnerability details Impact If votes are removed such that hasMajority is false but hasQuorum is true voting weight is in-between quorum and majority i.e. 50% and =66.6% for critical proposal types DAO, UTILS, RESERVE, GETSPARTA, ROUTER, LISTBOND, GRANT, ADDCURATEDPOOL, they will...
Canceled proposals can still be executed
Handle @cmichelio Vulnerability details Vulnerability Details Proposals that passed the threshold "finalized" can be cancelled by a minority again using the cancelProposal functions. It only sets mapPIDvotes to zero but mapPIDtimeStart and mapPIDfinalising stay the same and pass the checks in...
Proposals can be cancelled
Handle @cmichelio Vulnerability details Vulnerability Details Anyone can cancel any proposals by calling DAO.cancelProposalid, id with oldProposalID == newProposalID. This always passes the minority check as the proposal was approved. Impact An attacker can launch a denial of service attack on th...
Completed proposals can be voted on and executed again
Handle @cmichelio Vulnerability details Vulnerability Details A proposal that is completed has its state reset, including the votes. Users can just vote on it again and it can be executed again. Impact Completed proposals should most likely not be allowed to be voted on / executed again. This cou...
Undefined behavior for DAO and GRANT vote proposals in DAO.sol
Handle 0xRajeev Vulnerability details Impact Given that there are only three proposal types GRANT, UTILS, REWARD that are actionable, it is unclear if 'DAO' type checked in voteProposal is a typographical error and should really be 'GRANT'. Otherwise, GRANT proposals will only require quorum 33%...
GigToDo 1.3 - Cross-Site Scripting
GigToDo 1.3 - Cross-Site Scripting Exploit Title: GigToDo - Freelance Marketplace Script v1.3 Persistent XSS Injection Google Dork: - Date: 2019/07/28 Author: m0ze Vendor Homepage: https://www.gigtodoscript.com Software Link: https://codecanyon.net/item/gigtodo-freelance-marketplace-script/238553...
BlueHat v17 Call for Papers Opens
Calling security professionals and enthusiasts throughout the world. Microsoft is pleased to open the Call for Papers for our BlueHat v17 Security Conference. Potential speakers have from June 1st through August 18th to submit abstract proposals for this unique opportunity. As in past events, we...
BlueHat v17 Call for Papers Opens
Calling security professionals and enthusiasts throughout the world. Microsoft is pleased to open the Call for Papers for our BlueHat v17 Security Conference. Potential speakers have from June 1st through August 18th to submit abstract proposals for this unique opportunity. As in past events, we...
Lobbyists Press Trump to Support Strong Encryption, Surveillance Reform
A lobbying organization that includes some of the Internet’s most valuable entities made a plea to President-Elect Donald Trump to support the expansion of strong encryption and reform government surveillance activities. The Internet Association on Monday sent a letter to Trump’s transition team...
DARPA Seeks Revolution, Not Evolution, in Cyberspace Capabilities
Defense Advanced Research Projects Agency DARPA, the avant-garde research and development arm of the Department of Defense – perhaps best known for its central role in the development of the Internet – is soliciting research proposals that would help the military improve its cyber battlespace...
E-Mails Hacked By Anonymous Hackers Raise Concerns !
Late last year, activists attacked websites belonging to companies that refused to do business with WikiLeaks, an online group that has disclosed classified U.S. government documents. When the activists, who called themselves Anonymous, found out they were being investigated by the Internet...
shaadiclone-bypass.txt
============================================================================== / \ | | | | / \ | | | | / \ | | | | / \ | || | / \ | | | | / \ | | IN THE NAME OF // \ || || // \ || || ============================================================================== / | | || | | \ | | / \ | |/ / | | |...
ipsec-tools: racoon memory leak caused by invalid proposals
Memory leak in racoon/proposal.c in the racoon daemon in ipsec-tools before 0.7.1 allows remote authenticated users to cause a denial of service memory consumption via invalid proposals...
