CVE-2024-27095

Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1...

CVE-2024-27090

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded such as a...

CVE-2024-32469

Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter perpage. This vulnerability is fixed in 0.27.6 and 0.28.1...

CVE-2024-32469

Decidim core/package suffers an XSS vulnerability in pagination via the GET parameter per_page. Affected versions include older Decidim releases; the issue is mitigated by upgrading to at least 0.27.6 or 0.28.1 (or higher). Public docs from Red Hat, GitHub advisories, and CVE references confirm t...

CVE-2024-27095

CVE-2024-27095 affects the Decidim admin panel with a cross-site scripting (XSS) flaw that can be triggered when an attacker modifies records uploaded to the server. The issue is fixed in Decidim releases 0.27.6 and 0.28.1 (and related decidim-admin patches). Connected advisories consistently des...

CVE-2024-27090 Decidim vulnerable to data disclosure through the embed feature

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded such as a...

CVE-2024-27090

CVE-2024-27090 affects the Decidim framework (Ruby on Rails). A vulnerability exists where an attacker who can infer the slug or URL of an unpublished/private resource that is embeddable (e.g., a Participatory Process, Assembly, Proposal, Result) could access data from that resource. The issue is...

CVE-2024-27090 Decidim vulnerable to data disclosure through the embed feature

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded such as a...

Upcoming Book on AI and Democracy

If youve been reading my blog, youve noticed that I have written a lot about AI and democracy, mostly with my co-author Nathan Sanders. I am pleased to announce that were writing a book on the topic. This isnt a book about deep fakes, or misinformation. This is a book about what happens when AI...

Rethinking Democracy for the Age of AI

There is a lot written about technologys threats to democracy. Polarization. Artificial intelligence. The concentration of wealth and power. I have a more general story: The political and economic systems of governance that were created in the mid-18th century are poorly suited for the 21st...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: Im appearing on a panel on Society and Democracy at ACM Collective Intelligence in Boston, Massachusetts. The conference runs from June 26 through 29, 2024, and my panel is at 9:00 AM on Friday, June 28. Im speaking on "Reimagining...

How AI Will Change Democracy

I dont think its an exaggeration to predict that artificial intelligence will affect every aspect of our society. Not by doing new things. But mostly by doing things that are already being done by humans, perfectly competently. Replacing humans with AIs isnt necessarily interesting. But when an A...

Democracy Poll <= 6.0.3 - Missing Authorization

Description The Democracy Poll plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.0.3. This makes it possible for unauthenticated attackers to perform an unauthorized action...

CVE-2024-33920

Missing Authorization vulnerability in Kama Democracy Poll.This issue affects Democracy Poll: from n/a through 6.0.3...

CVE-2024-33920 WordPress Democracy Poll plugin <= 6.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kama Democracy Poll.This issue affects Democracy Poll: from n/a through 6.0.3...

CVE-2024-33920

CVE-2024-33920 describes a missing-authorization vulnerability in the Democracy Poll WordPress plugin (Kama Democracy Poll). The Red Hat and Wordfence entries in Connected documents indicate this affects Democracy Poll versions up to 6.0.3 and label the issue as missing authorization. The CVSS da...

CVE-2024-33920 WordPress Democracy Poll plugin <= 6.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kama Democracy Poll.This issue affects Democracy Poll: from n/a through 6.0.3...

WordPress plugin Democracy Poll 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Democracy Poll plugin <= 6.1.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by thiennv Patchstack Alliance in WordPress Plugin Democracy Poll versions = 6.1.1...

WordPress Democracy Poll Plugin <= 6.0.3 is vulnerable to Broken Access Control

Software Democracy Poll Type Plugin Vulnerable versions = 6.0.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33920 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 4ebe2afd67c8 Credits thiennv Required privilege...