CVE-2020-8989

In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices, which makes it easier for remote attackers to discover this voter's choice by sniffing the network. For example, a small amount of sniffed data may indicate that a vote was cast for the candidate with the least metadata. An active man-in-the-middle attacker can leverage this behavior to disrupt voters' abilities to vote for a candidate opposed by the attacker.

• CWE-203

• https://blog.voatz.com/?p=1209Vendor Advisory
• https://internetpolicy.mit.edu/wp-content/uploads/2020/02/SecurityAnalysisOfVoatz_Public.pdfThird Party Advisory
• https://blog.voatz.com/?p=1209Vendor Advisory
• https://internetpolicy.mit.edu/wp-content/uploads/2020/02/SecurityAnalysisOfVoatz_Public.pdfThird Party Advisory

Published

Feb 13, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8983An arbitrary file write issue exists in all versions of Citr…7.5
• CVE-2020-8984lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP…7.5
• CVE-2020-8985ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF v…8.8
• CVE-2020-8986lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to …9.8
• CVE-2020-8987Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.…7.4
• CVE-2020-8988The Voatz application 2020-01-01 for Android allows only 100…5.9
• CVE-2020-8990Western Digital My Cloud Home before 3.6.0 and ibi before 3.…9.1
• CVE-2020-8991vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mis…2.3
• CVE-2020-8992ext4_protect_reserved_inode in fs/ext4/block_validity.c in t…5.5
• CVE-2020-8994An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.…6.8
• CVE-2020-8995Programi Bilanc Build 007 Release 014 31.01.2020 supplies a …9.8
• CVE-2020-8996AnyShare Cloud 6.0.9 allows authenticated directory traversa…4.3