CVE-2024-0847 5280 Bootstrap Modal Contact Form <= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages

The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in class-sbmm-list-table.php. This makes it possible for unauthenticated attackers to bulk delete...

CVE-2024-4083

CVE-2024-4083 highlights a CSRF vulnerability in the WordPress plugin “Easy Restaurant Table Booking” up to version 1.0.0. The root cause is missing or incorrect nonce validation when saving settings, enabling unauthenticated attackers to trigger settings changes through forged requests if a site...

PT-2024-18025 · WordPress · Responsive Contact Form Builder & Lead Generation Plugin

Name of the Vulnerable Software and Affected Versions: The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress versions up to, and including, 1.8.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on several...

PT-2024-29086 · WordPress · Easy Restaurant Table Booking

Name of the Vulnerable Software and Affected Versions: Easy Restaurant Table Booking plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation when saving settings. This allows...

PT-2024-15863 · WordPress · 5280 Bootstrap Modal Contact Form

Name of the Vulnerable Software and Affected Versions: 5280 Bootstrap Modal Contact Form plugin for WordPress versions up to, and including, 1.0 Description: The issue is due to missing or incorrect nonce validation in class-sbmm-list-table.php, making it possible for unauthenticated attackers to...

PT-2024-29115 · WordPress · Cm Tooltip Glossary – Powerful Glossary Plugin

Name of the Vulnerable Software and Affected Versions: CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress versions up to, and including, 4.2.11 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation when saving settings. This...

PT-2024-18325 · WordPress · Analytify – Google Analytics Dashboard For Wordpress

Name of the Vulnerable Software and Affected Versions: The Analytify – Google Analytics Dashboard For WordPress plugin for WordPress versions up to, and including, 5.2.3 Description: The issue allows authenticated attackers with subscriber access or higher to obtain certain sensitive information...

PT-2024-24446 · WordPress · Paid Memberships Pro

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress versions up to, and including, 3.0.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce...

PT-2024-22941 · WordPress · Svs Pricing Tables

Name of the Vulnerable Software and Affected Versions: SVS Pricing Tables plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is due to missing or incorrect nonce validation on the deletePricingTable function, making it possible for unauthenticated attackers to delete...

Serious Slider <= 1.2.4 - Cross-Site Request Forgery

Description The Serious Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action...

ClickCease Click Fraud Protection <= 3.2.6 - Cross-Site Request Forgery

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administrator into performing an...

Contact Form 7 Extension For Mailchimp <= 0.5.70 - Cross-Site Request Forgery

Description The Contact Form 7 Extension For Mailchimp plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.70. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform...

Financio < 1.1.4 - Cross-Site Request Forgery to Notice Dismissal

Description The Financio theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.3. This is due to missing or incorrect nonce validation on the noticeclosed function. This makes it possible for unauthenticated attackers to dismiss notices via a...

MF Gig Calendar <= 1.2.1 - Cross-Site Request Forgery

Description The MF Gig Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action...

CVE-2023-50053

An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce random number...

CVE-2023-50059

An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe, the signed message lacks a nonce random number...

gnutls: vulnerable to Minerva side-channel information leak

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLSPRIVKEYFLAGREPRODUCIBLE flag, it can result in a noticeable step in nonce...

kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack

A vulnerability was found in Linux Kernel, where Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack. When an attacker connects to a victim device using the address of the device and the victim initiates a Pairing, the attacker can reflect the encrypted nonce even...

CVE-2023-50053

An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce random number...

CVE-2023-50059

An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe, the signed message lacks a nonce random number...