418 matches found
CVE-2022-27228
CVE-2022-27228 affects Bitrix Site Manager’s built-in vote (Polls, Votes) module prior to version 21.0.100. A remote unauthenticated attacker can execute arbitrary code on affected systems due to the module’s vulnerability, with CVSS overall high impact (C/H/I/A all high) reported in multiple sou...
CVE-2022-27228
In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...
8x8 Bounty: Jitsi: Attacker is able to cast a vote using the Victim's name on the Polls
The poll feature used to send user JIDs and names included in protocol messages, rather than derive from the XMPP session of the sender. Consequently, anyone in the conference could send messages with fake senderId or voterId values, and arbitrarily forge polls and votes. Jitsi Security Advisory...
nationalpopularvote.com Cross Site Scripting vulnerability OBB-2435360
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Vulnerability of the “vote” module in the content management system (CMS) of 1C-Bitrix: Website management related to the ability to send specially crafted network packets, allowing attackers to upload arbitrary files into the vulnerable system.
Vulnerability of the “vote” module in the content management system CMS of 1C-Bitrix: Website management involves the ability to send specially crafted network packets. Exploiting this vulnerability can allow a malicious actor to upload arbitrary files into the vulnerable system...
You can flip governance decisions without extending vote duration
Handle camden Vulnerability details Impact The impact here is that a user can, right at the end of the voting period, flip the decision without triggering the logic to extend the vote duration. The user doesn't even have to be very sophisticated: they can just send one vote in one transaction to ...
CVE-2021-24945 Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtnexportvotes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog...
WordPress Like Button Rating plugin <= 2.6.37 - Unauthorized Vote Export to Email & IP Addresses Disclosure vulnerability
Unauthorized Vote Export to Email & IP Addresses Disclosure vulnerability discovered by Krzysztof Zając in WordPress Like Button Rating plugin versions = 2.6.37. Solution Update the WordPress Like Button Rating plugin to the latest available version at least 2.6.38...
Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure
The plugin does not have any authorisation and CSRF checks in the likebtnexportvotes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog. fetch"http://example.com/wp-admin/admin-ajax.php",...
PT-2021-23484 · Mediawiki +1 · Mediawiki +1
Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.36.2 Description: An issue was discovered in SecurePoll in the Growth extension, where simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote. Recommendations: For...
Vote removals for critical proposal types are not re-checked for hasMajority at execution
Handle 0xRajeev Vulnerability details Impact If votes are removed such that hasMajority is false but hasQuorum is true voting weight is in-between quorum and majority i.e. 50% and =66.6% for critical proposal types DAO, UTILS, RESERVE, GETSPARTA, ROUTER, LISTBOND, GRANT, ADDCURATEDPOOL, they will...
Microsoft’s Vote Tracking Software Clears a Major Hurdle
Hart InterCivic will be the first private vendor to partner with the company on using its open-source ElectionGuard system...
MyBB 1.8.25 - Poll Vote Count SQL Injection
Exploit Title: MyBB 1.8.25 - Poll Vote Count SQL Injection Exploit Author: SivertPL [email protected] Date: 20.03.2021 Description: Lack of sanitization in the "votes" parameter in "Edit Poll" causes a second-order semi-blind SQL Injection that is triggered when performing a "Move/Copy"...
MyBB 1.8.25 SQL Injection
Exploit Title: MyBB 1.8.25 - Poll Vote Count SQL Injection Exploit Author: SivertPL [email protected] Date: 20.03.2021 Description: Lack of sanitization in the "votes" parameter in "Edit Poll" causes a second-order semi-blind SQL Injection that is triggered when performing a "Move/Copy"...
A Homecoming Queen Was Arrested for Alleged Vote Hacking
Plus: A mysterious zero-day spree, a high-profile hacker indictment, and more of the week’s top security news...
MyBB SQL Injection Vulnerability (CNVD-2021-25710)
MyBB is a free open source forum software. A SQL injection vulnerability exists in vote counting in versions of MyBB prior to 1.8.26, no details of the vulnerability are available at this time...
CVE-2021-27946
SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. issue 1 of 3...
CVE-2021-27946
SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. issue 1 of 3...
