WordPress plugin DW Question & Answer Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress DW Question...

PT-2022-9468

Name of the Vulnerable Software and Affected Versions DW Question & Answer Pro WordPress plugin versions 1.3.4 and earlier Description The issue allows attackers to make logged-in users perform unwanted actions due to insufficient CSRF checks in some functions. This can lead to updates of comment...

CVE-2021-24805: Cross-Site Request Forgery (CSRF)

The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status...

WordPress DW Question & Answer Pro premium plugin <= 1.3.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities were discovered by Brandon Roldan in WordPress DW Question & Answer Pro premium plugin versions = 1.3.4. Solution No patched version is available...

WordPress DW Question & Answer Pro premium plugin <= 1.3.4 - Arbitrary Comment Edition via IDOR vulnerability

Arbitrary Comment Edition via IDOR vulnerability discovered by Brandon Roldan in WordPress DW Question & Answer Pro premium plugin versions = 1.3.4. Solution No patched version is available...

Security Bulletin: IBM Answer Retrieval for Watson Discovery is vulnerable to phishing attacks due to Swagger UI (CVE number(s) 221508)

Summary Swagger UI is used by IBM Answer Retrieval for Watson Discovery. CVE numbers 221508. The fix upgrades to Swagger UI v4.6.2. Vulnerability Details Third Party Entry: 221508 DESCRIPTION: Swagger UI could allow a remote attacker to conduct phishing attacks, caused by an open redirect...

Dnsmasq 2.86 has a heap-based buffer overflow in answer_request (called from FuzzAnswerTheRequest and fuzz_rfc1035.c). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities to the best of our knowledge.

...

CVE-2021-45957

Dnsmasq 2.86 has a heap-based buffer overflow in answerrequest called from FuzzAnswerTheRequest and fuzzrfc1035.c. NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge...

CVE-2021-45954

Dnsmasq 2.86 has a heap-based buffer overflow in extractname called from answerauth and FuzzAuth. NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge...

AZL-8964 CVE-2021-45957 affecting package dnsmasq for versions less than 2.89-2

Dnsmasq 2.86 has a heap-based buffer overflow in answerrequest called from FuzzAnswerTheRequest and fuzzrfc1035.c. NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge...

Dnsmasq 缓冲区错误漏洞

dnsmasq is a lightweight DNS forwarding and DHCP and TFTP server written in C. It can be used as a server to forward DNS, DHCP, and TFTP. Dnsmasq 2.86 suffers from a buffer error vulnerability that stems from a heap-based buffer overflow in extractname called from answerauth and FuzzAuth...

CVE-2021-45957

Dnsmasq 2.86 has a heap-based buffer overflow in answerrequest called from FuzzAnswerTheRequest and fuzzrfc1035.c. NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge...

Audio bugging with the Fisher Price Chatter Bluetooth Telephone

The Fisher Price Chatter Bluetooth Telephone is a reincarnation of a familiar kids toy. It acts as a Bluetooth headset, so the user can connect their smartphone to it and take calls using the kids phone handset. Cute! Unfortunately, little to no consideration has been given to privacy and securit...

CVE-2021-1854

A call termination issue with was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A legacy cellular network can automatically answer an incoming call when an ongoing call ends or drops...

CVE-2021-1854

A call termination issue with was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A legacy cellular network can automatically answer an incoming call when an ongoing call ends or drops...

PT-2021-13622

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.5 iPadOS versions prior to 14.5 Description: A call termination issue was addressed with improved logic. The issue allowed a legacy cellular network to automatically answer an incoming call when an ongoing call ends o...

PT-2021-7558

Name of the Vulnerable Software and Affected Versions YOP Poll WordPress plugin versions prior to 6.3.1 Description The issue is related to a stored Cross-Site Scripting problem in the Admin preview module. It arises due to insufficient validation of question and answer text parameters in the...

CVE-2021-24454

In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. Th...

PT-2021-15980

Name of the Vulnerable Software and Affected Versions YOP Poll WordPress plugin versions prior to 6.2.8 Description The issue arises when a poll is created with specific options, leading to Stored Cross-Site Scripting issues. This occurs because the 'Other' answer is not sanitized before being...

CVE-2021-24454: Improper Neutralization of Input During Web Page Generation

In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. Th...