CVE-2024-45986

Projectworld Online Voting System 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. The flaw occurs when an account is registered with a malicious JavaScript payload, which is stored and later executed in voter.php and profile.php whenever account information is accessed. Affected d...

CVE-2024-45987

Summary: CVE-2024-45987 affects Projectworld Online Voting System 1.0, with a CSRF vulnerability exploitable via the voter.php endpoint. An attacker can craft a malicious link that, when clicked by an authenticated user, submits a vote for a chosen party without user consent, abusing the user’s a...

cauuu (>=0.1.0 <=0.1.1), cosmwasm-simulate (>=0.13.2 <=0.13.6) +10 more potentially affected by unknown CVE via cosmwasm-vm (>=0.10.1 <=0.9.4)

cosmwasm-vm CARGO version =0.10.1, =0.1.0, =0.13.2, =0.4.0, =0.4.0, =0.2.0, =0.4.0, =0.2.0, =0.2.1, =0.1.12, =0.1.13 - terra-math =0.0.0 - terraswap =1.0.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0366...

AI, election security headline discussions at Black Hat and DEF CON

As promised, Im back this week to recap some of the top stories coming out of Black Hat and DEF CON. Also as promised, AI was the talk of Vegas during Hacker Summer Camp or at least from what Ive been reading and hearing, I wasnt there in person. Several exhibitions and talks at both conferences...

The top stories coming out of the Black Hat cybersecurity conference

Over the next two weeks, two of the largest cybersecurity conferences in the world will take place in Las Vegas: Black Hat and DEF CON. That means product announcements, buzzwords and stories about "X smart appliance could burn your house down!" or something like that. Over the next two weeks, Il...

A Senate Bill Would Radically Improve Voting Machine Security

This year’s Intelligence Authorization Act would mandate penetration testing for federally certified voting machines and allow independent researchers to work on exposing vulnerabilities...

CVE-2024-2235

The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack...

Himer - Social Questions and Answers < 2.1.1 - Bypass Poll Voting Restrictions via CSRF

Description The theme does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack PoC The PoC will be displayed on June 26, 2024, to give users the time to update...

Himer - Social Questions and Answers < 2.1.1 - Bypass Poll Voting Restrictions via CSRF

Description The theme does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack The PoC will be displayed on June 26, 2024, to give users the time to update...

GO-2024-2638 ValidateVoteExtensions function in Cosmos SDK may allow incorrect voting power assumptions in github.com/cosmos/cosmos-sdk

The default ValidateVoteExtensions helper function infers total voting power based on the injected VoteExtension, which are injected by the proposer. If your chain utilizes the ValidateVoteExtensions helper in ProcessProposal, a dishonest proposer can potentially mutate voting power of each...

CVE-2024-32514 WordPress WP Poll Maker plugin <= 3.4 - Authenticated Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Poll Maker & Voting Plugin Team InfoTheme WP Poll Maker.This issue affects WP Poll Maker: from n/a through 3.4...

voting-station.net Cross Site Scripting vulnerability OBB-3900056

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-29818

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Poll Maker & Voting Plugin Team InfoTheme WP Poll Maker allows Stored XSS.This issue affects WP Poll Maker: from n/a through 3.1...

CVE-2024-29818 WordPress WP Poll Maker plugin <= 3.1 - Authenticated Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Poll Maker & Voting Plugin Team InfoTheme WP Poll Maker allows Stored XSS.This issue affects WP Poll Maker: from n/a through 3.1...

CVE-2024-29818

CVE-2024-29818 – Stored XSS in WP Poll Maker (Poll Maker & Voting Plugin) for WordPress. Root cause: Improper neutralization of input during web page generation (Cross-site Scripting). Affected: WP Poll Maker versions from n/a through 3.1. The connected Red Hat entry repeats the same description;...

On Secure Voting Systems

Andrew Appel shepherded a public comment--signed by twenty election cybersecurity experts, including myself--on best practices for ballot marking devices and vote tabulation. It was written for the Pennsylvania legislature, but its general in nature. From the executive summary: We believe that no...

GHSA-95RX-M9M5-M94V ASA-2024-006: ValidateVoteExtensions helper function in Cosmos SDK may allow incorrect voting power assumptions

ASA-2024-006: ValidateVoteExtensions helper function may allow incorrect voting power assumptions Component: Cosmos SDK Criticality: High Affected Versions: Cosmos SDK versions = 0.50.4, on 0.50 branches Affected Users: Chain developers, Validator and Node operators Impact: Elevation of Privilege...

ASA-2024-006: ValidateVoteExtensions helper function in Cosmos SDK may allow incorrect voting power assumptions

ASA-2024-006: ValidateVoteExtensions helper function may allow incorrect voting power assumptions Component: Cosmos SDK Criticality: High Affected Versions: Cosmos SDK versions = 0.50.4, on 0.50 branches Affected Users: Chain developers, Validator and Node operators Impact: Elevation of Privilege...

BIT-MEDIAWIKI-2020-35624

An issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1. The non-admin vote list contains a full vote timestamp, which may provide unintended clues about how a voting process unfolded...

CVE-2024-1823

A vulnerability classified as critical was found in CodeAstro Simple Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file users.php of the component Backend. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit h...