Cross site request forgery (csrf)

The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwpupdatepasswordaction' function. This makes it possible for unauthenticated attackers to change user password via...

CVE-2023-4916 Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Change

The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwpupdatepasswordaction' function. This makes it possible for unauthenticated attackers to change user password via...

PT-2023-31077 · WordPress · Login With Phone Number Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Login with phone number plugin for WordPress versions up to, and including, 1.5.6 Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation on the lwp update password action function. This allows...

CVE-2023-41936

Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, potentially allowing attackers to use statistical methods to obtain a valid token...

CVE-2023-41936

Summary : CVE-2023-41936 affects Jenkins Google Login Plugin 1.7 and earlier. The vulnerability arises from a non-constant time token comparison function used when verifying the provided versus expected token, enabling attackers to use statistical methods to obtain a valid token. The connected so...

CVE-2023-38476

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in SuiteDash :: ONE Dashboard® Client Portal : SuiteDash Direct Login plugin = 1.7.6 versions...

CVE-2023-38476

CVE-2023-38476 : Auth. (admin+) Stored XSS in the WordPress plugin “SuiteDash Direct Login” for SuiteDash :: ONE Dashboard Client Portal, affected

CVE-2023-37986

CVE-2023-37986 affects the miniOrange YourMembership Single Sign On (YM SSO) Login WordPress plugin, versions

CVE-2023-34172

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Miled WordPress Social Login plugin = 3.0.4 versions...

CVE-2023-34023

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Miled WordPress Social Login plugin = 3.0.4 versions...

CVE-2023-34172

CVE-2023-34172 describes an authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WordPress Social Login (Miled WordPress Social Login) up to version ≤ 3.0.4. Root cause: stored XSS likely via admin-accessible vector in the plugin. Impact: local XSS could ...

CVE-2023-32505

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Arshid Easy Hide Login plugin = 1.0.7 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Arshid Easy Hide Login plugin = 1.0.7 versions...

Jenkins plugins Multiple Vulnerabilities (2022-12-07)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. CVE-2022-46682 - Jenki...

CVE-2023-37947

A flaw was found in the Jenkins OpenShift Login Plugin. Affected versions of this plugin could allow a remote attacker to conduct phishing attacks caused by an open redirect vulnerability. An attacker can use a specially crafted URL to redirect a victim to arbitrary web sites...

CVE-2023-37946

A flaw was found in the Jenkins OpenShift Login Plugin. Affected versions of this plugin could allow a remote attacker to bypass security restrictions caused by not invalidating the existing session on login. By persuading a victim to visit a specially crafted Web site, an attacker can gain...

Jenkins OpenShift Login Plugin vulnerable to Open Redirect

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after...

Jenkins OpenShift Login Plugin session fixation vulnerability

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. OpenShift Login Plugin 1.1.0.230.v5d7030bf5432 invalidates the existing session...

CVE-2023-37946

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier does not invalidate the previous session on login...

CVE-2023-37947

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...