PT-2021-23939 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse affected versions not specified Description: A vulnerability in the Polls feature of Discourse allowed users to vote multiple times in a single-option poll. The issue is related to the Polls feature, but specific details about...

Cross-Site Request Forgery (CSRF) in erudika/scoold

✍️ Description The /voteup/question/ endpoint does not have a CSRF protection. This could be exploited by an attacker to manipulate votes in a question. 🕵️‍♂️ Proof of Concept An attacker creates the following web page and sends a link to a logged in user. // PoC.html Click Here When an...

Openslide Cross-Site Scripting Vulnerability

Openslide is Openslide organization of a C-based code library used to read slide files . The software supports reading files in svs,tif,vms,vmu,ndpi,scn,mrxs,tiff,svslide,tif,bif,tif formats. A cross-site scripting vulnerability exists in OpenSlides, which stems from insufficient user input...

BigBlueButton has an unspecified vulnerability (CNVD-2022-82641)

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. versions prior to BigBlueButton 2.2.29 have a security vulnerability that could be exploited by an attacker to cast multiple votes in a single poll...

CVE-2020-28953

In BigBlueButton before 2.2.29, a user can vote more than once in a single poll...

Code injection

In BigBlueButton before 2.2.29, a user can vote more than once in a single poll...

CVE-2020-28953

In BigBlueButton before 2.2.29, a user can vote more than once in a single poll, enabling poll manipulation. The available description does not specify the underlying root cause, exact component/file, or affected versions beyond the 2.2.29 threshold. No remediation details are provided in the doc...

BigBlueButton 安全漏洞

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. versions prior to BigBlueButton 2.2.29 have a security vulnerability that could be exploited by an attacker to cast multiple votes in a single poll...

New Zealand Election Fraud

It seems that this election season has not gone without fraud. In New Zealand, a vote for "Bird of the Year" has been marred by fraudulent votes: More than 1,500 fraudulent votes were cast in the early hours of Monday in the countrys annual bird election, briefly pushing the Little-Spotted Kiwi t...

2020 Was a Secure Election

Over at Lawfare: "2020 Is An Election Security Success Story So Far." What’s more, the voting itself was remarkably smooth. It was only a few months ago that professionals and analysts who monitor election administration were alarmed at how badly unprepared the country was for voting during a...

Donald Trump Hasn't ‘Already Won’ the Election

Despite the president’s claims of victory, his reelection bid depends on a huge number of votes that have yet to be counted...

CVE-2009-0936

Unspecified vulnerability in Tor before 0.2.0.34 allows attackers to cause a denial of service infinite loop via "corrupt votes."...

Design/Logic Flaw

The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list...

CVE-2019-9914

The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes pollid XSS...

Node.js third-party modules: [increments] sql injection

I would like to report SQL Injection in increments. It allows creating fake polls. Module module name: increments version: 1.2.1 npm page: https://www.npmjs.com/package/increments Module Description Increment is a database-driven for creating polls and taking votes for various options, candidates...

CVE-2014-6046

Multiple cross-site request forgery CSRF vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that 1 delete active users by leveraging improper validation of CSRF tokens or that 2 delete open questions, 3 activate users, 4...

CVE-2014-6046

Multiple cross-site request forgery CSRF vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that 1 delete active users by leveraging improper validation of CSRF tokens or that 2 delete open questions, 3 activate users, 4...

Opponents Vow to Continue the Fight after Trump Reauthorizes Domestic Spying Law

A controversial U.S. legal framework concerning domestic surveillance is poised to live on for another six years, but opponents say they plan to continue the fight. In a widely expected move, President Donald Trump signed the bill one day after the Senate approved it in a 65-34 vote. At issue is...

CVE-2015-6839

The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multiple votes for a candidate via a crafted RFID ballot tag...

Design/Logic Flaw

The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multiple votes for a candidate via a crafted RFID ballot tag...