Governance wrong vote

Lines of code Vulnerability details Description There is a function vote in OlympusGovernance smart contract. This function must accept a vote for or against a proposal. But it is possible that someone will wote not for the proposal he expected: this is possible to activate another proposal using...

CVE-2022-1600

The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based limitations to vote in certain situations...

Malicious code in beefy-vote (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d988bd7a2dd36f0e525ae3c882066ff746f92744089f356e231dc20157b278c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1494 Malicious code in beefy-vote (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d988bd7a2dd36f0e525ae3c882066ff746f92744089f356e231dc20157b278c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4643 Malicious code in mkr-vote-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e05531ac5fce7d87dbf96176e86c0753c627fa875718ce405741d2e18ebc3367 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mkr-vote-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e05531ac5fce7d87dbf96176e86c0753c627fa875718ce405741d2e18ebc3367 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

_writeCheckpoint() in Gauge use wrong index to get prevVoteStatus

Lines of code Vulnerability details Impact All the Voting values calculated by writeCheckpoint when it's not first checkpoint is going to set to False instead of account's last vote and because vote has been used in earned and reward calculation so reward distribution is going to be wrong too...

User rewards stop accruing after any _writeCheckpoint calling action

Lines of code Vulnerability details Any user balance affecting action, i.e. deposit, withdraw/withdrawToken or getReward, calls writeCheckpoint to update the balance records used for the earned reward estimation. The issue is that writeCheckpoint always sets false to voted flag for the each new...

Helpful < 4.5.15 - Votes Tampering

The plugin allowed users to vote more than once, which could allow attackers to increase votes drastically on some posts...

WordPress Helpful Plugin <= 4.5.14 - Vote Tampering Vulnerability

Vote Tampering vulnerability discovered by Suriya Prakash, Arun Nithyanandam, SaiManoj in Helpful plugin versions = 4.5.14 Solution Update the WordPress Helpful plugin to the latest available version at least 4.5.15...

CVE-2022-0769

The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the datatarget parameter before it is being interpolated in an SQL statement and then executed via the ratingvote AJAX action available to both unauthenticated and authenticated users, leading to an SQL Injection...

CVE-2022-0769

The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the datatarget parameter before it is being interpolated in an SQL statement and then executed via the ratingvote AJAX action available to both unauthenticated and authenticated users, leading to an SQL Injection...

WordPress plugin Users Ultra SQL注入漏洞

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Users Ultra has a SQL injection vulnerability, which stems from the inability to properly clean and escape the datatarget...

CVE-2022-27228

In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...

CVE-2022-27228

In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...

CVE-2022-27228

CVE-2022-27228 affects Bitrix Site Manager’s built-in vote (Polls, Votes) module prior to version 21.0.100. A remote unauthenticated attacker can execute arbitrary code on affected systems due to the module’s vulnerability, with CVSS overall high impact (C/H/I/A all high) reported in multiple sou...

8x8 Bounty: Jitsi: Attacker is able to cast a vote using the Victim's name on the Polls

The poll feature used to send user JIDs and names included in protocol messages, rather than derive from the XMPP session of the sender. Consequently, anyone in the conference could send messages with fake senderId or voterId values, and arbitrarily forge polls and votes. Jitsi Security Advisory...

nationalpopularvote.com Cross Site Scripting vulnerability OBB-2435360

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Vulnerability of the “vote” module in the content management system (CMS) of 1C-Bitrix: Website management related to the ability to send specially crafted network packets, allowing attackers to upload arbitrary files into the vulnerable system.

Vulnerability of the “vote” module in the content management system CMS of 1C-Bitrix: Website management involves the ability to send specially crafted network packets. Exploiting this vulnerability can allow a malicious actor to upload arbitrary files into the vulnerable system...

You can flip governance decisions without extending vote duration

Handle camden Vulnerability details Impact The impact here is that a user can, right at the end of the voting period, flip the decision without triggering the logic to extend the vote duration. The user doesn't even have to be very sophisticated: they can just send one vote in one transaction to ...