Threatpost Poll: Can We Fix 2FA?

In the wake of the release of a penetration testing tool called Modlishka that shows how easy it is to bypass login protections for accounts protected by mainstream two-factor authentication 2FA, the tool’s author in his write-up asked, “is 2FA broken?” It’s a provocative question, so we asked...

Phabricator: Exposing voting results on the Slowvote application without actually voting

Description There is a feature on the Phabricator Slowvote application which allows creating polls and asking questions. The poll creator can choose to only allow people who voted to actually see the poll results. However, it seems that by sending an illegal vote a user can still see the poll's...

Modbus Poll 7.2.2 - Denial of Service (PoC)

Exploit Title: Modbus Poll 7.2.2 - Denial of Service PoC Discovery by: Cemal Cihad ÇİFTÇİ Discovery Date: 2018-10-19 Tested Version: 7.2.2 Vulnerability Type: DOS Tested on OS: Windows XP Professional Service Pack 3 Vendor Homepage: https://www.modbustools.com Download Link:...

Modbus Poll 7.2.2 Denial Of Service

Exploit Title: Modbus Poll 7.2.2 - Denial of Service PoC Discovery by: Cemal Cihad AAdegFTAAdeg Discovery Date: 2018-10-19 Tested Version: 7.2.2 Vulnerability Type: DOS Tested on OS: Windows XP Professional Service Pack 3 Vendor Homepage: https://www.modbustools.com Download Link:...

Modbus Poll 7.2.2 - Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: Modbus Poll 7.2.2 - Denial of Service PoC Discovery by: Cemal Cihad ÇİFTÇİ Tested Version: 7.2.2 Vulnerability Type: DOS Tested on OS: Windows XP Professional Service Pack 3 Vendor Homepage: https://www.modbustools.com Download Lin...

Wordpress Survey & Poll 1.5.7.3 Plugin - sss_params SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Survey & Poll 1.5.7.3 - 'sssparams' SQL Injection Exploit Author: Ceylan Bozogullarindan Vendor Homepage: http://modalsurvey.pantherius.com/ Software Link:...

Wordpress Plugin Survey Poll 1.5.7.3 - sss_params SQL Injection

Wordpress Plugin Survey Poll 1.5.7.3 - sssparams SQL Injection Exploit Title: Wordpress Plugin Survey & Poll 1.5.7.3 - 'sssparams' SQL Injection Date: 2018-09-09 Exploit Author: Ceylan Bozogullarindan Vendor Homepage: http://modalsurvey.pantherius.com/ Software Link:...

WordPress Plugin Survey & Poll 1.5.7.3 - 'sss_params' SQL Injection

Exploit Title: Wordpress Plugin Survey & Poll 1.5.7.3 - 'sssparams' SQL Injection Date: 2018-09-09 Exploit Author: Ceylan Bozogullarindan Vendor Homepage: http://modalsurvey.pantherius.com/ Software Link: https://downloads.wordpress.org/plugin/wp-survey-and-poll.zip Version: 1.5.7.3 Tested on:...

WordPress Survey And Poll 1.5.7.3 SQL Injection

Exploit Title: Wordpress Plugin Survey & Poll 1.5.7.3 - 'sssparams' SQL Injection Date: 2018-09-09 Exploit Author: Ceylan Bozogullarindan Vendor Homepage: http://modalsurvey.pantherius.com/ Software Link: https://downloads.wordpress.org/plugin/wp-survey-and-poll.zip Version: 1.5.7.3 Tested on:...

Design/Logic Flaw

An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than select, exhaustion of file descriptors would cause the server to enter an infinite loop, consuming a large amount of CPU time and denying service to other clients until restarted...

CVE-2018-14621

An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than select, exhaustion of file descriptors would cause the server to enter an infinite loop, consuming a large amount of CPU time and denying service to other clients until restarted...

CVE-2018-14621

An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than select, exhaustion of file descriptors would cause the server to enter an infinite loop, consuming a large amount of CPU time and denying service to other clients until restarted...

Design/Logic Flaw

In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference IDOR via the Poll ID, leading to the ability of a single user to select multiple Poll Options e.g., vote for multiple items...

CVE-2018-15833

In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference IDOR via the Poll ID, leading to the ability of a single user to select multiple Poll Options e.g., vote for multiple items...

CVE-2018-0299

A vulnerability in the Simple Network Management Protocol SNMP feature of Cisco NX-OS on the Cisco Nexus 4000 Series Switch could allow an authenticated, remote attacker to cause the device to unexpectedly reload, resulting in a denial of service DoS condition. The vulnerability is due to...

CVE-2018-0309

A vulnerability in the implementation of a specific CLI command and the associated Simple Network Management Protocol SNMP MIB for Cisco NX-OS in standalone NX-OS mode on Cisco Nexus 3000 and 9000 Series Switches could allow an authenticated, remote attacker to exhaust system memory on an affecte...

poll-maker.com XSS vulnerability

Open Bug Bounty ID: OBB-630400 Description| Value ---|--- Affected Website:| poll-maker.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Vanilla: Able to Select Every Poll Option[http://tedwebers-famous-loudspeakers.vanillacommunities.com]

Summary: Hello I would like to report a bug in which i was able to select multiple poll options even when a user is only allowed to select a single option. Description: In the New discussion are of the site http://tedwebers-famous-loudspeakers.vanillacommunities.com , there is an option to create...

Flexible Poll SQL Injection Vulnerability

Flexible Poll is a dynamic online poll management system. A SQL injection vulnerability exists in Flexible Poll version 1.2. A remote attacker can inject SQL commands by sending the 'id' parameter to the index.php or mobilepreview.php file...

CVE-2018-5988

SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobilepreview.php or index.php...