NounsDAOLogicV2's state() and proposals() will use initial dynamic params for all V1 proposals

Lines of code Vulnerability details state and proposals call quorumVotesid that utilize initial dynamic params for all V1 proposals by misusing 0 as a proposal creation block. I.e. new field is referenced while it is zero for all V1 proposals. This way all V1 proposals will use the same initial s...

OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals

Impact This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirement, past proposals ma...

GHSA-XRC4-737V-9Q75 OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals

Impact This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirement, past proposals ma...

Business Logic Flaws

OpenZeppelin Contracts has business logic flaw. The vulnerability exists due to a lack of sanitization of past quorum allowing it to be executable when a new quorum meets the smart contract's requirement...

CVE-2022-31198

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a...

Design/Logic Flaw

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a...

CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a...

CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a...

CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a...

PT-2022-20606 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions prior to 4.7.2 Description: This issue concerns instances of Governor that use the module GovernorVotesQuorumFraction, a mechanism that determines quorum requirements as a percentage of the voting token's total...

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin versions 4.3.0 through 4.7.2, and OpenZeppelin contracts-upgradeable versions 4.3.0 through 4.7.2, which stems from the fact that when a proposal is passed to...

GHSA-CCQF-C5HQ-77MP Missing Authorization in Apache ZooKeeper

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader...

Security Bulletin: IBM Data Management Platform for EDB Postgres Standard is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105, CVE-2021-45046)

Summary IBM Data Management Platform for EnterpriseDB EDB Postgres Standard contains a component called EDB Failover Manager EFM and uses a version of Apache Log4j that impacts high availability in EDB. The upgraded EFM product contains Apache Log4j 2.17.1. Vulnerability Details CVEID:...

Security Bulletin: IBM Data Management Platform for EDB Postgres Enterprise is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-45105, CVE-2021-45046)

Summary IBM Data Management Platform for EnterpriseDB EDB Postgres Enterprise contains a component called EDB failover manager EFM and uses a version of log4j that impacts high availability in EDB. The upgraded EFM product contains Apache Log4j 2.17.1. Vulnerability Details CVEID: CVE-2021-45105...

NCH Quorum Cross-Site Scripting Vulnerability (CNVD-2021-55898)

NCH Quorum is a teleconference server software. It can turn any computer into a conference call server. A cross-site scripting vulnerability exists in NCH Quorum, which could be exploited by attackers to steal cookie-based authentication credentials from victims...

NCH Quorum Cross-Site Scripting Vulnerability

NCH Quorum is a teleconference server software. It can turn any computer into a conference call server. A cross-site scripting vulnerability exists in NCH Quorum, which stems from the product's /conferencebrowseuploadfile?confid=failure to properly handle user input data and can be exploited to...

NCH Quorum Information Disclosure Vulnerability

NCH Quorum is a teleconference server software. It can turn any computer into a conference call server. An information disclosure vulnerability exists in NCH Quorum, which stems from the fact that the product does not add valid permissions for access to the local .dat file, which could be exploit...

Multiple vulnerabilities in NCH Quorum (CNVD-2021-55904)

NCH Quorum is a teleconference server software. It can turn any computer into a teleconference server. The caller dials into the server to participate in a conference call. A directory traversal and arbitrary file deletion vulnerability exists in NCH Quorum, which can be exploited by an attacker ...

NCH Quorum has multiple vulnerabilities

NCH Quorum is a teleconference server software. It can turn any computer into a conference call server. NCH Quorum is vulnerable to directory traversal and arbitrary file deletion, which can be exploited to view or delete any file on a remote system via path traversal in a separate function...

NCH Quorum Cross-Site Scripting Vulnerability (CNVD-2021-57429)

NCH Quorum is software that runs as a teleconferencing server on a Windows PC. A cross-site scripting vulnerability exists in NCH Quorum 2.03 and earlier versions. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via /uploaddoc?id=...