5065 matches found
WordPress Redux Framework <= 4.1.23 - Cross-Site Request Forgery (CSRF) Nonce Validation Bypass vulnerability
Cross-Site Request Forgery CSRF Nonce Validation Bypass vulnerability found by ErwanLR in WordPress Redux Framework versions 4.1.22 - 4.1.23. Solution Update the WordPress Redux Framework to the latest available version at least 4.1.24...
WordPress Redux Framework plugin <= 4.1.20 - CSRF Nonce Validation Bypass vulnerability
CSRF Nonce Validation Bypass vulnerability discovered by Lenon Leite in WordPress Redux Framework plugin versions = 4.1.20. Solution Update the WordPress Redux Framework plugin to the latest available version at least 4.1.21...
Redux Framework 4.1.22 - 4.1.23 - CSRF Nonce Validation Bypass
The plugin re-introduced a CSRF bypass issue in v4.1.22, as the nonce is only checked if present in the request...
Contextual Related Posts < 2.9.4 - CSRF Nonce Validation Bypass
The plugin does not properly check for the CSRF nonce in the export and import features, which could allow attackers to make authenticated logged in administrators perform those actions via a CSRF attack. To bypass the nonce validation, just don't send the crpexportsettingsnonce or...
WordPress Contextual Related Posts plugin <= 2.9.3 - Cross-Site Request Forgery (CSRF) Nonce Validation Bypass vulnerability
Cross-Site Request Forgery CSRF Nonce Validation Bypass vulnerability found by Lenon Leite in WordPress Contextual Related Posts plugin versions = 2.9.3. Solution Update the WordPress Contextual Related Posts plugin to the latest available version at least 2.9.3...
Contextual Related Posts < 2.9.4 - CSRF Nonce Validation Bypass
The plugin does not properly check for the CSRF nonce in the export and import features, which could allow attackers to make authenticated logged in administrators perform those actions via a CSRF attack. PoC To bypass the nonce validation, just don't send the crpexportsettingsnonce or...
Improper Authentication
Overview react-adal is an Azure Active Directory Library ADAL support for ReactJS. Affected versions of this package are vulnerable to Improper Authentication. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly...
WordPress Real-Time Find and Replace Cross-Site Request Forgery Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Real-Time Find and Replace is a content find and replace plugin used in it. A cross-site request forgery vulnerability exists in...
WordPress SiteOrigin Page Builder Cross-Site Request Forgery Vulnerability
WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.SiteOrigin Page Builder is a page builder plugin used in it. A cross-site request forgery vulnerability exists in...
Insufficient Nonce Validation in Eclipse Milo Client
Impact Credential replay affecting those connected to a server when all 3 of the following conditions are met: - SecurityPolicy is None - using username/password or X509-based authentication - the server has a defect causing it to send null/empty or zeroed nonces Patches The problem has been...
GHSA-PQ4W-QM9G-QX68 Insufficient Nonce Validation in Eclipse Milo Client
Impact Credential replay affecting those connected to a server when all 3 of the following conditions are met: - SecurityPolicy is None - using username/password or X509-based authentication - the server has a defect causing it to send null/empty or zeroed nonces Patches The problem has been...
CVE-2020-8658
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...
CVE-2020-8658
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...
CVE-2019-11289
Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash...
CVE-2019-11289
CVE-2019-11289 – Impact and fix (Cloud Foundry Routing Gorouter) : All Cloud Foundry Routing versions before 0.193.0 are affected due to improper validation of nonce input. A remote unauthenticated attacker could forge a route service request using an invalid nonce, potentially causing the Gorout...
CVE-2019-11289 A forged route service request using an invalid nonce can cause the gorouter to panic and crash
Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash...
CVE-2019-11289: Gorouter header denial of service vulnerability | Cloud Foundry
Severity High Vendor Cloud Foundry Foundation Description Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash...
WordPress WP Social Feed Gallery Plugin < 2.4.8 Authentication Bypass Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.113508";...