benregenspan
Joined 16 years ago
Joined 16 years ago
For the Wordpress RCE (nominally CVSS 9.2), it looks like many standard deployments of WordPress would be affected, barring extra mitigations. But in the case of these Hugo ones (9.3), it looks like very specific circumstances (anti-mitigations, if you will) are needed. E.g. running arbitrary builds of untrusted user content without a sandbox; running it in a GitHub workflow against PRs from untrusted contributors, etc.
Maybe that 90% number is for Tel Aviv. In national polls, they both have roughly the same approval rating.
It looks like the methodology involves subtracting the founder's entire net worth, so selling the shares would leave him in the same place.
I think the fact that the above issue has been open for a very long time is one indication of how difficult and sensitive this type of access control API is. The Google Drive API could be a proving ground for getting the UX right for this (including tricky details like how to manage persistent access to a folder with clear disclosure and user controls).