2155 matches found
Responsive Poll < 1.3.4 - Broken Authentication and Missing Capability Checks on AJAX calls
Edit WPScanTeam: In versions 1.3.3, unauthenticated users can manipulate polls, e.g., delete, clone, or view a hidden poll. In versions 1.3.4 any authenticated user can do the same as above v1.3.4 added capability checks, however the issues are still exploitable via CSRF as there is no nonce chec...
WordPress Responsive Poll plugin <= 1.3.2 - Unauthenticated Manipulation With Polls (delete, clone, or view a hidden poll) vulnerability
Unauthenticated Manipulation With Polls delete, clone, or view a hidden poll vulnerability discovered by pak0s in WordPress Responsive Poll plugin versions = 1.3.2. Solution Update the WordPress Responsive Poll plugin to the latest available version at least 1.3.4...
Covid-19 Poll Results: One in Four Prioritize Health Over Privacy
One in four respondents to a Threatpost reader poll said they were okay with sacrificing a portion of their personal privacy in exchange for some form of cellphone tracking that could – in theory – reduce coronavirus infection rates and save lives. While the majority of Threatpost readers were...
Covid-19 Privacy Poll: Phone Tracking, Public Health and Surveillance
As the coronavirus pandemic accelerates, authorities worldwide are plotting ways to flatten the curve of infection rates using potentially privacy-busting measures such as phone tracking, facial recognition and other tech. In this Threatpost poll, we want your take on whether sacrificing personal...
A COVID-19 Cybersecurity Poll: Securing a Remote Workforce
As the coronavirus pandemic continues to sweep the globe, and cities and states impose social-distancing measures, businesses are sending their users home to work. And this massive, unprecedented shift to distance working brings with it a whole new set of cybersecurity challenges. For instance, a...
CVE-2020-7050
Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...
CVE-2013-1401
Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll...
Sql injection
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or pollid parameter in a viewPollResults or userlogs action...
Security feature bypass
Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll...
CVE-2013-1401
Cardoza WordPress Poll plugin for WordPress (versions around 34.05/34.5) contains multiple vulnerable functions (editAnswer, deleteAnswer, addAnswer, deletePoll) that can be reached via external AJAX calls. The issues enable remote attackers to manipulate polls (add/edit/delete answers, delete po...
CVE-2013-1401
Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll...
CVE-2013-1400
CVE-2013-1400 affects Cardoza WordPress Poll plugin (34.05) / Cardoza WordPress Poll plugin 34.05. The vulnerability is in CWPPoll.js (viewPollResults and userlogs) where the poll_id pollid parameter is not sanitized, allowing remote SQL injections. This can enable manipulation of backend data or...
CVE-2013-1400
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or pollid parameter in a viewPollResults or userlogs action...
PoC Exploits Do More Good Than Harm: Threatpost Poll
When it comes to the release of proof-of-concept PoC exploits, more security experts agree that the positives outweigh the negatives, according to a recent and informal Threatpost poll. Last week, Threatpost conducted a reader poll and almost 60 percent of 230 security pundits thought it was a...
Unspecified Vulnerability in Comtech Telecommunications Stampede FX-1010 (CNVD-2020-14360)
The Comtech Telecommunications Stampede FX-1010 is a data center product from Comtech Telecommunications. A security vulnerability exists in the Comtech Telecommunications Stampede FX-1010 version 7.4.3. A remote attacker can exploit this vulnerability by navigating to the Poll Routes page and...
CVE-2020-7244
Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Poll Routes page and entering shell metacharacters in the Router IP Address field. In some cases, authentication can be achieved with the comtech password for the...
CVE-2020-7244
Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Poll Routes page and entering shell metacharacters in the Router IP Address field. In some cases, authentication can be achieved with the comtech password for the...
Remote code execution
Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Poll Routes page and entering shell metacharacters in the Router IP Address field. In some cases, authentication can be achieved with the comtech password for the...
PT-2020-19494
Name of the Vulnerable Software and Affected Versions Comtech Stampede FX-1010 version 7.4.3 Description The issue allows remote authenticated administrators to achieve remote code execution by navigating to the "Poll Routes" page and entering shell metacharacters in the Router IP Address field. ...
