Locked funds from tokenization are credited twice to user leading to protocol fund loss

Handle 0xRajeev Vulnerability details Impact The tokens optionally locked during tokenization are released twice on acquiring conviction back from a NFT. The incorrect double debit of locked funds during tokenization has been filed as a separate finding because it is not necessarily related and...

Conviction totals not updated during tokenization

Handle 0xRajeev Vulnerability details Impact updateConvictionScore function returns convictionDelta and governanceDelta which need to be used immediately in a call to updateConvictionTotalsconvictionDelta, governanceDelta for updating the conviction totals of conviction and governance-enabled...

Locked funds are debited twice from user during tokenization leading to fund loss

Handle 0xRajeev Vulnerability details Impact During tokenization of conviction scores, the user can optionally provide FSDs to be locked to let it continue conviction accrual. However, the amount of FSDs specified for locking are debited twice from the user leading to fund loss for user. This, in...

OESA-2021-1011 golang security update

The Go Programming Language.\r\n\r\n Security Fixes:\r\n\r\n The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2021-1025)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Undefined Behavior

encoding/xml in github.com/golang/go is vulnerable to undefined behavior. The vulnerability is possible because it does not correctly preserve the semantics of directives during tokenization round-trips...

Undefined Behavior

encoding/xml in github.com/golang/go is vulnerable to undefined behavior. The vulnerability is possible because it does not correctly preserve the semantics of directives during tokenization round-trips...

Incorrect Preservation Of Namespace Prefixes

encoding/xml in github.com/golang/go is performing incorrect preservation of namespace prefixes. An attacker is able to provide malicious inputs to cause conflicts in the way of preserving the namespace prefixes on XML elements during tokenization round-trips...

DEBIAN-CVE-2020-29510

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

CVE-2020-29510

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

AZL-78896 CVE-2020-29511 affecting package golang 1.25.7-1

The encoding/xml package in Go all versions does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

AZL-6448 CVE-2020-29509 affecting package golang for versions less than 1.20.10-1

The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

CVE-2020-29510

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

DEBIAN-CVE-2020-29511

The encoding/xml package in Go all versions does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

CVE-2020-29509

The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

AZL-6449 CVE-2020-29511 affecting package golang for versions less than 1.20.10-1

The encoding/xml package in Go all versions does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

AZL-78900 CVE-2020-29509 affecting package golang 1.26.7-1

The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

DEBIAN-CVE-2020-29509

The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

CVE-2020-29509

The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...

Code injection

The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...