CVE-2020-1683

On Juniper Networks Junos OS devices, a specific SNMP OID poll causes a memory leak which over time leads to a kernel crash vmcore. Prior to the kernel crash other processes might be impacted, such as failure to establish SSH connection to the device. The administrator can monitor the output of t...

CVE-2020-1683: Missing Release of Memory after Effective Lifetime

On Juniper Networks Junos OS devices, a specific SNMP OID poll causes a memory leak which over time leads to a kernel crash vmcore. Prior to the kernel crash other processes might be impacted, such as failure to establish SSH connection to the device. The administrator can monitor the output of t...

dbus security update

1:1.10.24-15.0.1 - fix netlink poll: error 4 Zhenzhong Duan 1:1.10.24-15 - Fix CVE-2020-12049 1851992...

WordPress Cardoza Poll plugin <= 36 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by zerodetail & ratherbland in WordPress Cardoza Poll plugin versions = 36. Solution 2020-12-30 - we were unable to find a patched version of this plugin. WordPress.org notification - "This plugin has been closed as of June 23, 2020 and is not...

PHP-Fusion Cross-Site Scripting Vulnerability (CNVD-2020-49953)

PHP-Fusion is a lightweight open source content management system. PHP-Fusion 9.03.60 suffers from a cross-site scripting vulnerability that can be exploited by attackers via infusions/memberpollpanel/polladmin.php...

CVE-2020-24315

Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database...

CVE-2020-24315

Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database...

Design/Logic Flaw

Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database...

CVE-2020-24315

CVE-2020-24315 affects the Vinoj Cardoza WordPress Poll Plugin (versions prior to 37). The root cause is missing input escaping on the pollid POST parameter, allowing an attacker to craft SQL statements that can dump the target database. Impact noted across sources as an SQL injection with potent...

CVE-2020-24315: Improper Neutralization of Special Elements used in an SQL Command

Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database...

PT-2020-15573

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.60 Description The issue concerns Cross Site Scripting XSS that can be executed via the infusions/member poll panel/poll admin.php file. Recommendations For PHP-Fusion version 9.03.60, update to a newer version that...

PT-2020-15680 · Vinoj Cardoza · Vinoj Cardoza Wordpress Poll Plugin

Name of the Vulnerable Software and Affected Versions: Vinoj Cardoza WordPress Poll Plugin versions prior to v37 Description: The issue allows users to execute SQL statements by crafting specific input, potentially leading to the dumping of the entire target's database. This is due to a lack of...

PT-2020-21927

Name of the Vulnerable Software and Affected Versions uWS affected versions not specified Description The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the us internal dispatch ready poll function, which is called by us loop run and ultimately by...

Cardoza WordPress Poll <= 36 - Authenticated SQL Injection

The Cardoza WordPress Poll plugin was vulnerable to authenticated SQL Injection in the "pollid" POST parameter when submitting a poll deletion request. PoC action=deletepoll=SELECT 2822 FROM SELECTSLEEP5gsJu...

dbus security update

1.12.8-10.0.1.el82 - fix netlink poll: error 4 Zhenzhong Duan 1:1.12.8-10 - Fix CVE-2020-12049 1851996...

dbus security update

1:1.10.24-14.0.1 - fix netlink poll: error 4 Zhenzhong Duan 1:1.10.24-14 - Fix CVE-2020-12049 1851991...

Automattic: Captcha checker "pd-captcha_form_SURVEYID" cookie is accepting any value

Summary: Hi team, There is a Captcha protection feature on surveys and polls. If you captcha protection enabled survey, you will see this : F901789 When you solve captcha and click Submit Captcha, website sets a cookie like this : F901799 And if you delete this cookie and try access to survey, yo...

ntp: DoS on client ntpd using server mode packet

A flaw was found in the Network Time Protocol NTP, where a security issue exists that allows an off-path attacker to prevent the Network Time Protocol daemon ntpd from synchronizing with NTP servers not using authentication. A server mode packet with a spoofed source address sent to the client nt...

curl: Poll loop/hang on incomplete HTTP header

Summary: When an incomplete server header is missing its value, the curl client will receive the packet but hang while parsing it. Examples of vulnerable server headers: Location, Content-Range and Connection. Adding the --max-timeoption will terminate the request as intended. Steps To Reproduce:...

WordPress YOP Poll plugin <= 6.1.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Jeroen Mulder in WordPress YOP Poll plugin versions = 6.1.4. Solution Update the WordPress YOP Poll plugin to the latest available version at least 6.1.5...