WordPress的YOP Poll插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress YOP Poll Plugin versions prior to 6.3.5, which stems...

CVE-2022-0205: Improper Neutralization of Input During Web Page Generation

The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings available to users with a role as low as author before outputting them, leading to a Stored Cross-Site Scripting issue...

ASB-A-185125206

In aiopollcompletework of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2022-28826

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.11 Description The issue is related to a data-race in dropmon net event and trace napi poll hit. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-28872

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.4 Description The issue concerns a fix for an indefinitely sleeping task in the poll schedule timeout function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-28603

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.231 Description The issue is related to a data-race in dropmon net event and trace napi poll hit. The actual impact and attack plausibility have not yet been proven. Recommendations For versions prior to...

PT-2022-28586

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 2.6.31 through 4.14.267 Description A data-race issue exists in the dropmon net event and trace napi poll hit functions. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-28568

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.303 Description The issue is related to a data-race in dropmon net event and trace napi poll hit. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-28627

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 2.6.31 through 5.4.180 Description The issue is related to a data-race in dropmon net event and trace napi poll hit. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-28672

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 2.6.31 through 5.10.101 Description A data-race issue exists in the dropmon net event and trace napi poll hit functions. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-28740

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.25 Description A data-race issue exists in the dropmon net event and trace napi poll hit functions. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-28457

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.95 Description The issue is related to a fix for an indefinitely sleeping task in the poll schedule timeout function. The actual impact and attack plausibility have not yet been proven. Recommendations For...

PT-2022-28516

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.18 Description The issue is related to a fix for an indefinitely sleeping task in the poll schedule timeout function. The actual impact and attack plausibility have not yet been proven. Recommendations For...

PT-2022-28396

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.227 Description The issue concerns a fix for an indefinitely sleeping task in the poll schedule timeout function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linu...

PT-2022-28423

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.175 Description The issue is related to a fix for an indefinitely sleeping task in the poll schedule timeout function. The actual impact and attack plausibility have not yet been proven. Recommendations For...

YOP Poll < 6.3.5 - Author+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of the settings available to users with a role as low as author before outputting them, leading to a Stored Cross-Site Scripting issue As author, put the following payload in the Settings Integration Use Google reCaptcha Yes Site Key: v v 6.3.5 - "...

YOP Poll < 6.3.5 - Author+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of the settings available to users with a role as low as author before outputting them, leading to a Stored Cross-Site Scripting issue PoC As author, put the following payload in the Settings Integration Use Google reCaptcha Yes Site Key: v v 6.3.5 - "...

CVE-2022-21671

@replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive information exists in versions prior to 7.3.1. When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are...

CVE-2022-21671

@replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive information exists in versions prior to 7.3.1. When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are...

CVE-2022-21671: Exposure of Sensitive Information to an Unauthorized Actor

@replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive information exists in versions prior to 7.3.1. When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are...