CVE-2022-41888 Unckecked rank size in `tf.image.generate_bounding_box_proposals` in Tensorflow

TensorFlow is an open source platform for machine learning. When running on GPU, tf.image.generateboundingboxproposals receives a scores input that must be of rank 4 but is not checked. We have patched the issue in GitHub commit cf35502463a88ca7185a99daa7031df60b3c1c98. The fix will be included i...

The Latest Funding News and What it Means for Cyber Security in 2023

The White House has recently announced a $1 billion cyber security grant program that is designed to help state and local governments improve their cyber defenses, especially about protecting critical infrastructure. The recent executive order stems from the $1.2 trillion infrastructure bill that...

PT-2022-22660 · Unknown · Hyperledger Fabric

Name of the Vulnerable Software and Affected Versions: Hyperledger Fabric versions prior to 2.4.6 Description: A vulnerability exists in Hyperledger Fabric that could allow an attacker to construct a non-validated request, potentially causing a denial of service attack. The peer gateway service...

Ddos in Governor.sol

Lines of code Vulnerability details Impact An attacker can cancel proposals. Proof of Concept The proposal ID depends on 4 variables:targets, values, calldatas, and descriptionHash. The Problem is that once a proposal is proposed and the proposal ID is stored, no matter if the proposal is execute...

USER CAN BLOCK GOVERNANCE VOTING BY SUBMITTING MULTIPLE PROPOSALS

Lines of code Vulnerability details Impact A user can submit multiple proposals and then endorse each one of them to be able to activate them, and because the Governance contract allow only one active proposal, this user will be able to always activate his proposals and thus not allowing any othe...

Lock of voting power

Lines of code Vulnerability details Description There is a function vote in OlympusGovernance smart contract. It contains the logic for voting on proposals. In the case of failed vote voters' tokens will remain on the balance of OlympusGovernance until the activation of the new proposal. But for...

NounsDAOLogicV2's state() and proposals() will use initial dynamic params for all V1 proposals

Lines of code Vulnerability details state and proposals call quorumVotesid that utilize initial dynamic params for all V1 proposals by misusing 0 as a proposal creation block. I.e. new field is referenced while it is zero for all V1 proposals. This way all V1 proposals will use the same initial s...

OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals

Impact This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirement, past proposals ma...

GHSA-XRC4-737V-9Q75 OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals

Impact This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirement, past proposals ma...

Attackers can abuse the quitLock function to get a very large amount of votes

Lines of code Vulnerability details Impact An attacker can use a flashloan and the quitLock function to achieve a large amount of votes for one transaction. It can, depends on the implementation of the modules that will use this contract, be used to pass malicious proposals or exploit any feature...

delegate modifies old checkpoint

Lines of code Vulnerability details Impact VoteEscrow tokens are used as voting tokens for a GovernorAlpha governance. It shouldn't be possible to modify an old meaning for blocks older than block.number checkpoint, otherwise it's possible to buy tokens just to vote for a proposal and then sell...

CVE-2021-46827

An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposals in online documentation generated using Oxygen XML WebHelp allows attackers to execute JavaScript by convincing a user to type specific...

CVE-2021-46827

An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposals in online documentation generated using Oxygen XML WebHelp allows attackers to execute JavaScript by convincing a user to type specific...

Incorrect Creation Of Governance Proposals

@openzeppelin/contracts performs incorrect creation of governance proposals. Using bad ABI encoding in GovernorCompatibilityBravo with explicit function signatures along with calldata results in incorrect creation of governance proposals with incorrect arguments...

GHSA-M6W8-FQ7V-PH4M GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior

Impact The GovernorCompatibilityBravo module may lead to the creation of governance proposals that execute function calls with incorrect arguments due to bad ABI encoding. This happens if the proposal is created using explicit function signatures, e.g. a proposal to invoke the function foouint256...

GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior

Impact The GovernorCompatibilityBravo module may lead to the creation of governance proposals that execute function calls with incorrect arguments due to bad ABI encoding. This happens if the proposal is created using explicit function signatures, e.g. a proposal to invoke the function foouint256...

Possible DoS attack in creating new DAO proposals

Handle shw Vulnerability details Impact The functions of creating new DAO proposals e.g., newActionProposal are permissionless. Anyone can create a new proposal by paying some fees in SPARTA, as long as the previous proposal is closed. Thus, an attacker could then front-run proposals of benign...

Vote removals for critical proposal types are not re-checked for hasMajority at execution

Handle 0xRajeev Vulnerability details Impact If votes are removed such that hasMajority is false but hasQuorum is true voting weight is in-between quorum and majority i.e. 50% and =66.6% for critical proposal types DAO, UTILS, RESERVE, GETSPARTA, ROUTER, LISTBOND, GRANT, ADDCURATEDPOOL, they will...

Canceled proposals can still be executed

Handle @cmichelio Vulnerability details Vulnerability Details Proposals that passed the threshold "finalized" can be cancelled by a minority again using the cancelProposal functions. It only sets mapPIDvotes to zero but mapPIDtimeStart and mapPIDfinalising stay the same and pass the checks in...

Proposals can be cancelled

Handle @cmichelio Vulnerability details Vulnerability Details Anyone can cancel any proposals by calling DAO.cancelProposalid, id with oldProposalID == newProposalID. This always passes the minority check as the proposal was approved. Impact An attacker can launch a denial of service attack on th...