PT-2023-28132 · Poll Maker Team · Poll Maker Plugin

Name of the Vulnerable Software and Affected Versions: Poll Maker Team Poll Maker plugin versions = 4.7.0 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

WordPress plugin Poll Maker - Best WordPress Poll Plugin Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Poll Maker - Best WordPres...

WordPress Poll Maker Plugin <= 4.7.0 is vulnerable to Cross Site Scripting (XSS)

Software Poll Maker Type Plugin Vulnerable versions = 4.7.0 Fixed in 4.7.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-41871 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fe5a513df2c9 Credits Le Ngoc Anh Required privilege...

WordPress Forminator Plugin < 1.24.1 Race Condition Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:incsub:forminator"; if description...

Keylime 安全漏洞

Keylime is an open source extensible trust system for Keylime that utilizes TPM technology. A security vulnerability exists in Keylime that stems from a vulnerability that could allow bypassing the Poll Response Protocol during agent registration...

dbus security update

1:1.12.20-7.0.1.1 - Fix CVE-2023-34969 2213402 1.12.20-7.0.1 - fix netlink poll: error 4 Zhenzhong Duan 1:1.12.20-7 - Fix CVE-2022-42010 2133647 - Fix CVE-2022-42011 2133641 - Fix CVE-2022-42012 2133635 1:1.12.20-6 - Override upstream sysusers.d confguration 2118226 1:1.12.20-5 - Rebuilt for IMA...

Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6249-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6249-1 advisory. Ruihan Li discovered that the memory management subsystem in the Linux kernel contained a race condition when accessing VMAs in certain conditions, leadi...

AZL-27759 CVE-2023-2430 affecting package kernel for versions less than 5.15.137.1-1

A vulnerability was found due to missing lock for IOPOLL flaw in iocqringeventoverflow in iouring.c in Linux Kernel. This flaw allows a local attacker with user privilege to trigger a Denial of Service threat...

OESA-2023-1425 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A use-after-free vulnerability in the Linux Kernel iouring subsystem can be exploited to achieve local privilege escalation. Racing a iouring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend...

CVE-2023-2010

The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll...

CVE-2023-2010 Forminator < 1.24.1 - Unauthenticated Race Condition on poll vote

The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll...

WordPress plugin Forminator 竞争条件问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A competitive conditions issue...

USN-6194-1 linux-oem-6.1 vulnerabilities

Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-35788, LP: 2023577 Xingyuan Mo and Gengjia Chen...

WordPress Poll Maker Plugin <= 4.6.2 is vulnerable to Server Side Request Forgery (SSRF)

Software Poll Maker Type Plugin Vulnerable versions = 4.6.2 Fixed in 4.6.3 OWASP Top 10 A5: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2023-34013 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 1e96fbd28aa6 Credits Khalid Yusuf Required...

Forminator < 1.24.1 - Unauthenticated Race Condition on poll vote

The plugin does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll. 1. Create a poll and publish a page with a poll. 2. Visit the page with the poll. ...

Forminator < 1.24.1 - Unauthenticated Race Condition on poll vote

The plugin does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll. PoC 1. Create a poll and publish a page with a poll. 2. Visit the page with the...

CVE-2023-28472

Concrete CMS previously concrete5 versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies...

CVE-2023-29779

Sengled Dimmer Switch V0.0.9 contains a denial of service DOS vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes. After receiving the malicious command, the device will keep reporting its status and finally drain its battery...

PT-2023-22415 · Sengled · Sengled Dimmer Switch

Name of the Vulnerable Software and Affected Versions: Sengled Dimmer Switch version 0.0.9 Description: The issue allows a remote attacker to send malicious Zigbee messages to a vulnerable device, causing it to crash. After receiving the malicious command, the device will continuously report its...

Broken Access Control in Vote/Friend Function

Description Unauthorized conduct by modifying, closing/re open a poll created by someone else. Delete friend of other account via id Proof of Concept Step 1: Use account 1 to create a poll\ \ account 2 not have perrmison edit/close/open on poll \ Step 2: Intercept request when account 1 edit,...