YOP Poll Plugin XSS

The vulnerability of the “Create poll” module in the YOP Poll plugin of the WordPress content management system is related to the lack of protection for website structure when processing parameters such as “Vote Button Label”, “Show Results Link”, and “Display Back to vote Link”. Exploiting this...

PT-2024-11850 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a race condition on the per-CQ variable napi work done in the Linux kernel's net component. After calling napi complete done, another CPU can start the napi...

TikTok: Any user can vote on `Friend Only` video pull

Vulnerability description not provided...

PT-2022-6197 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A use-after-free flaw was found in the io uring subcomponent of the Linux Kernel due to a race condition in the poll refs function. This issue may cause a NULL pointer dereference,...

WS-2022-0462

In jitsi-meet, the poll feature used to send user JIDs and names included in protocol messages, rather than derive from the XMPP session of the sender. Consequently, anyone in the conference could send messages with fake senderId or voterId values, and arbitrarily forge polls and votes...

kernel: block: null_blk: end timed out poll request

In the Linux kernel, the following vulnerability has been resolved: block: nullblk: end timed out poll request When poll request is timed out, it is removed from the poll list, but not completed, so the request is leaked, and never get chance to complete. Fix the issue by ending it in timeout...

Libtirpc: Denial of Service

Background Libtirpc is a port of Sun's Transport-Independent RPC library to Linux. Description Currently svcrun does not handle poll timeout and rendezvousrequest does not handle EMFILE error returned from accept2 as it used to. These two missing functionality were removed by commit b2c9430f46c4...

Gas, a positive social network for teens (no, really)

A new social network is currently in the news, billed as a positive space for teens to enjoy themselves. Im all for positive spaces online, but what is it, and will teens really be happier there than say Instagram, or even just hanging out in WhatsApp groups? Pump the gas Launched in August of th...

Denial Of Service (DoS)

linux-kvm is vulnerable to denial of service. The vulnerability exists because the iouring poll does not properly handle POLLFREE, allowing an attacker to crash the application through the use after free...

Automattic: Archived / Deleted / Private Poll Can Be Viewed by Another Users [Crowdsignal WordPress plugins]

This issue was reported by @apapedulimu in CrowdSignal. The private or deleted polls on https://app.crowdsignal.com questions/answers, not results could be viewed by other users through the editor in the CrowdSignal plugin. Happy to learn and work with the Automattic team!...

CVE-2022-3176

A use-after-free flaw was found in iouring in the Linux kernel. This flaw allows a local user to trigger the issue if a signalfd or binder fd is polled with the iouring poll due to a lack of iouring POLLFREE handling...

Linux Heap Buffer Overflow DoS

The vulnerability of the Signalfdpoll and binderpoll functions in Linux operating systems is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

GSD-2022-1005748 net: Fix a data-race around sysctl_net_busy_poll.

net: Fix a data-race around sysctlnetbusypoll. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.140 by commit...

PT-2022-34458

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.292 Description A data-race issue exists around sysctl net busy poll. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v4.14.292, update...

PT-2022-34343

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.257 Description A data-race issue exists around sysctl net busy poll. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v4.19.257, update...

PT-2022-34197 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 3.11 through 5.4.211 Description: A data-race issue exists around sysctl net busy poll. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions 3.11 through 5.4.211,...

PT-2022-34006 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.140 Description: A data-race issue exists around sysctl net busy poll. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v5.10.140,...

DEBIAN-CVE-2022-3176

There exists a use-after-free in iouring in the Linux kernel. Signalfdpoll and binderpoll use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the iouring poll doesn't handle POLLFREE. This allows a...

PT-2022-33305 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.6 Description: A data-race issue exists around sysctl net busy poll. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v5.19.6, update ...

PT-2025-43092

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel’s regulator core that can lead to an integer underflow. This occurs when a non-integer ratio is used between delay and poll enabled time, causing time...