1412 matches found
VetoProposal: proposals cannot be vetoed in all states in which it should be possible to veto proposals
Lines of code Vulnerability details Impact The VetoProposal contract allows to veto proposals with the voteToVeto function. The proposal can only be vetoed when it is in the Voting state, otherwise the voteToVeto function reverts. The issue is that the Voting state is not the only state in which ...
CVE-2023-24403
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP For The Win bbPress Voting plugin = 2.1.11.0 versions...
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP For The Win bbPress Voting plugin = 2.1.11.0 versions...
CVE-2023-24403 WordPress bbPress Voting Plugin <= 2.1.11.0 is vulnerable to Cross-Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP For The Win bbPress Voting plugin = 2.1.11.0 versions...
CVE-2023-24403 WordPress bbPress Voting Plugin <= 2.1.11.0 is vulnerable to Cross-Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP For The Win bbPress Voting plugin = 2.1.11.0 versions...
CVE-2023-24403
The CVE-2023-24403 entry describes a Stored XSS vulnerability in the WordPress bbPress Voting plugin (WP For The Win) versions
WordPress Plugin bbPress Voting 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
PT-2023-19565
Name of the Vulnerable Software and Affected Versions WP For The Win bbPress Voting plugin versions prior to 2.1.11.0 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations For WP For The Wi...
CVE-2023-24403: Improper Neutralization of Input During Web Page Generation
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP For The Win bbPress Voting plugin = 2.1.11.0 versions...
Malicious member can steal funds from the DAO contract.
Lines of code Vulnerability details Impact The malicious member can steal assets from DAO protocol. Proof of Concept The protocol allows the member to have the voting power to create a proposal createProposal. Where the action struct in the parameter refers to be consumed by the DAO's execute...
User may force fail the action from the DAO:execute
Lines of code Vulnerability details Description The execute function from the DAO.sol contract allow to execution of any call to any address if the caller has appropriate permission. Some calls are expected to be always successfully executed, and some may revert and execute will continue the...
Multisig: Users can approve proposals even after getting removed
Lines of code Vulnerability details Impact The Multisig contract intends to enable the creation and approval of proposals among a predetermined list of multisig addresses. The multisig addresses can be added or removed by a authorative identity. While creating a new proposal a snapshotBlock...
createProposal snapshot block can temporarily desync with minApproval / minVotingPower
Lines of code Vulnerability details Impact minApproval and member list will be temporarily out of sync, potentially causing approval issues Proof of Concept uint64 snapshotBlock = block.number.toUint64 - 1; ... // Create the proposal Proposal storage proposal = proposalsproposalId;...
SUSE CVE-2018-0490
An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service NULL pointer dereference and directory-authority crash via a misformatted rel...
WordPress bbPress Voting Plugin <= 2.1.11.0 is vulnerable to Cross Site Scripting (XSS)
Software bbPress Voting Type Plugin Vulnerable versions = 2.1.11.0 Fixed in 2.1.11.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24403 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1339fe1c9dad Credits Rio Darmawan...
bbPress Voting < 2.1.11.1 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
BigBlueButton 安全漏洞
BigBlueButton is an open source web conferencing system from the BigBlueButton community. A security vulnerability exists in BigBlueButton versions prior to 2.4.0, which stems from exposing sensitive information to unauthorized participants, and affects voting meetings where the attacker is a...
Reimagining Democracy
Last week, I hosted a two-day workshop on reimagining democracy. The idea was to bring together people from a variety of disciplines who are all thinking about different aspects of democracy, less from a "what we need to do today" perspective and more from a blue-sky future perspective. My remit ...
WordPress plugin WP-Polls 安全漏洞
WP-Polls is a WordPress polling plugin. A vulnerability exists in WordPress WP-Polls versions prior to 2.76.0 to bypass IP-based restrictions. The vulnerability stems from prioritizing the IP of visitors from certain HTTP headers instead of PHP's REMOTEADDR, which can be exploited by an attacker ...
