PT-2024-33706 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server affected versions not specified Description: The issue affects instances with SAML SSO and encrypted assertions, allowing an attacker to forge a SAML response and gain admin privileges and unrestricted access to the...

The vulnerability of the displaySettings function in the Cacti network monitoring software allows a hacker to execute cross-site scripting.

The vulnerability of the displaySettings function in the Cacti network monitoring software relates to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow a malicious actor to execute cross-site scripting using forged cookie files...

VulnCheck KEV: CVE-2021-40655

D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page...

CVE-2024-1230

The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorrect nonce validation on the maybedisconnectsimpleshop function. This makes it possible for unauthenticated attackers to disconnect the site...

sshpiper Data Forgery Issue Vulnerability

sshpiper is a reverse proxy for sshd by Boshi Lian Personal Developers. A data forgery vulnerability exists in sshpiper 1.0.50 and earlier versions, which stems from the way the proxy protocol listener is implemented that may allow an attacker to forge its connection address...

CVE-2024-4463 Squelch Tabs and Accordions Shortcodes <= 0.4.7 - Cross-Site Request Forgery

The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.7. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to modify...

CVE-2024-4463

CVE-2024-4463 affects the Squelch Tabs and Accordions Shortcodes WordPress plugin. The issue is a Cross-Site Request Forgery (CSRF) due to missing/incorrect nonce validation when saving plugin settings, allowing unauthenticated attackers to modify settings by tricking a site administrator into pe...

CVE-2024-4314

CVE-2024-4314 affects the Hostel WordPress plugin up through version 1.1.5.3, where CSRF exists due to missing/incorrect nonce validation in room management. This allows unauthenticated attackers to trigger actions (e.g., create or delete rooms) by enticing an admin to click a crafted link. The C...

hostel < 1.1.5.4 - Cross-Site Request Forgery

Description The Hostel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5.3. This is due to missing or incorrect nonce validation when managing rooms. This makes it possible for unauthenticated attackers to create and delete rooms via a...

The vulnerability of the digital signature and XML encryption library for Node.js’ xml-crypto, related to improper verification of cryptographic signatures, allows attackers to forge digital signatures.

The vulnerability of the digital signature and encryption library for Node.js’ xml-crypto is related to improper validation of the cryptographic signature. Exploiting this vulnerability allows a malicious actor to forge digital signatures by inserting a newly created, specially crafted signature...

CVE-2023-7065

The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.4. This is due to missing or incorrect nonce validation on the sfsprocess AJAX action. This makes it possible for...

PT-2024-15194 · WordPress · Stop Spammers Security

Name of the Vulnerable Software and Affected Versions: Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress versions up to, and including, 2024.4 Description: The issue is due to missing or incorrect nonce validation on the sfs process AJAX action, making it possible fo...

YITH WooCommerce Compare < 2.38.0 - Cross-Site Request Forgery

Description The YITH WooCommerce Compare is vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to add/remove things from a product compare via a forged request granted they can...

CVE-2024-2959

The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the savePricingTable function. This makes it possible for unauthenticated attackers to create and edit prici...

CVE-2024-0613

The Delete Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3.1. This is due to missing or incorrect nonce validation on the ajaxdeletefield function. This makes it possible for unauthenticated attackers to delete arbitrary pos...

CVE-2024-3215

CVE-2024-3215 affects the Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions WordPress plugin. It is a CSRF vulnerability caused by missing or incorrect nonce validation in pmpro_update_level_group_order(), allowing unauthenticated attackers to update order levels...

CVE-2024-2959 SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creation

The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the savePricingTable function. This makes it possible for unauthenticated attackers to create and edit prici...

ClickCease Click Fraud Protection <= 3.2.6 - Cross-Site Request Forgery

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administrator into performing an...

Podlove Podcast Publisher < 4.0.15 - Cross-Site Request Forgery

Description The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.14. This is due to missing or incorrect nonce validation on the jobcreate and jobdelete functions. This makes it possible for unauthenticated...

Flash Video Player <= 5.0.4 - Cross-Site Request Forgery

Description The Flash Video Player plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action v...