Vulnerabilities Affecting Dominion Voting Systems ImageCast X

1. SUMMARY This advisory identifies vulnerabilities affecting versions of the Dominion Voting Systems Democracy Suite ImageCast X, which is an in-person voting system used to allow voters to mark their ballot. The ImageCast X can be configured to allow a voter to produce a paper record or to...

PT-2022-3253

Name of the Vulnerable Software and Affected Versions Dominion Voting Systems ImageCast X affected versions not specified Description The authentication mechanism used by voters to activate a voting session is susceptible to forgery. An attacker could leverage this issue to print an arbitrary...

PT-2022-3266

Name of the Vulnerable Software and Affected Versions Dominion Voting Systems ImageCast X affected versions not specified Description The authentication mechanism used by technicians on the Dominion Voting Systems ImageCast X is susceptible to forgery. An attacker with physical access may use thi...

Voting overwrites checkpoint.voted in last checkpoint, so users can just vote right before claiming rewards

Lines of code Vulnerability details Impact if cp0.voted reward += cp0.balanceOf rewardPerTokenStored1 - rewardPerTokenStored0 / PRECISION; this line in gauge.earned function looks like the intention here is to incentivize users to keep their escrow.balanceOfNft voted for this gauge. However, it's...

Voting tokens may be lost when given to non-EOA accounts

Lines of code Vulnerability details Impact veNFTs may be sent to contracts that cannot handle them, and therefore all rewards and voting power, as well as the underlying are locked forever Proof of Concept The original code had the following warning: @dev Safely transfers tokenId token from from ...

Voting Escrow System could be wrapped and made useless without contract whitelisting

Lines of code Vulnerability details Impact Anyone could create a contract or a contract factory, say “Velo Locker" with a fonction to deposit VELO tokens through a contract, lock them and delegate the voting power to the contract owner. Then, the ownership of this contract could be sold, or the...

Increase voting power by tokenizing the address that locks the token

Lines of code Vulnerability details Impact Without restriction on the type of address that lock the token, a bad actor could lock the token through the smart contract. Doing so enable him to make the lockedToken becomes liquidate by tokenize his smart contract which defeat the purpose of the...

Improperly Skewed Governance Mechanism

Lines of code Vulnerability details ALR-02H: Improperly Skewed Governance Mechanism | File | Lines | Type ---|---|--- AuraLocker.sol | L594-L609, L611-L618 | Governance Susceptibility Description The balance checkpointing system exposed by the contract for governance purposes is flawed as it does...

Locking up AURA Token does not increase voting power of individual

Lines of code Vulnerability details Background Per the documentation, AURA tokens can be locked in the AuraLocker to recieve vlAURA. vlAURA is voting power in the AURA ecosystem. It is also possible for the users to delegate their voting power to a specific address by calling the...

Voting power of new validators not checked in updateValset function, Gravity.sol

Lines of code Gravity.solL276-L358 Vulnerability details Impact While the voting power of the current valset is checked when the checkValidatorSignatures function is called in updateValset, the power of the new valset is not. This could cause some functions to not work since whenever...

Admin has ability to rugpull all tokens

Lines of code Vulnerability details Impact Currently it is possible for the admin to pull all tokens belonging to the Gravity bridge. In normal circumstances this is probably fine, but if the admin account were compromised this would lead to the bridge being drained of locked funds. Furthermore, ...

voting-station.net Cross Site Scripting vulnerability OBB-2536938

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Delegations incorrectly tracked when multiple delegate() calls occur in the same block

Lines of code Vulnerability details The README.md states: If the user has a Lock, and delegates to someone, then the bonus voting power is not counted. Impact Accounts are still able to claim bonus voting power even if they delegate to someone else, and any operations that rely on the public...

Fake Esports voting sites looking to phish Steam users

We’ve seen Esports occasionally become the focus of gaming or Steam scams. One particular tactic of note was to claim joining an official league is an easy process. Links to third-party hosted files would offer up a supposedly cracked ESEA Esports league client. In reality, it was a data stealing...

WordPress WP Voting Contest plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress WP Voting Contest plugin version 2.1 and previous versions have a cross-site scripting vulnerability, which originates from...

CVE-2022-0321

The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the postid parameter before outputting it back in the response via the wpvcsocialshareicons AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0321

The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the postid parameter before outputting it back in the response via the wpvcsocialshareicons AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

Cross site scripting

The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the postid parameter before outputting it back in the response via the wpvcsocialshareicons AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0321 WP Voting Contest < 3.0 - Reflected Cross-Site Scripting

The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the postid parameter before outputting it back in the response via the wpvcsocialshareicons AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0321

The CVE-2022-0321 entry applies to the WordPress WP Voting Contest plugin (pre-3.0). The issue is a Reflected Cross-Site Scripting vulnerability caused by the plugin not sanitising/escaping the post_id parameter before echoing it in the wpvc_social_share_icons AJAX response, accessible to unauthe...