PT-2024-24446 · WordPress · Paid Memberships Pro

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress versions up to, and including, 3.0.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce...

PT-2024-29115 · WordPress · Cm Tooltip Glossary – Powerful Glossary Plugin

Name of the Vulnerable Software and Affected Versions: CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress versions up to, and including, 4.2.11 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation when saving settings. This...

CVE-2024-4086: Cross-Site Request Forgery (CSRF)

The CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.11. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to chan...

PT-2024-15689

Name of the Vulnerable Software and Affected Versions Delete Custom Fields plugin for WordPress versions up to, and including, 0.3.1 Description The issue is due to missing or incorrect nonce validation on the ajax delete field function, making it possible for unauthenticated attackers to delete...

CVE-2024-4083: Cross-Site Request Forgery (CSRF)

The Easy Restaurant Table Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's...

CVE-2024-2960: Cross-Site Request Forgery (CSRF)

The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the deletePricingTable function. This makes it possible for unauthenticated attackers to delete pricing tabl...

Serious Slider <= 1.2.4 - Cross-Site Request Forgery

Description The Serious Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action...

ClickCease Click Fraud Protection <= 3.2.6 - Cross-Site Request Forgery

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administrator into performing an...

Contact Form 7 Extension For Mailchimp <= 0.5.70 - Cross-Site Request Forgery

Description The Contact Form 7 Extension For Mailchimp plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.70. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform...

MF Gig Calendar <= 1.2.1 - Cross-Site Request Forgery

Description The MF Gig Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action...

Financio < 1.1.4 - Cross-Site Request Forgery to Notice Dismissal

Description The Financio theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.3. This is due to missing or incorrect nonce validation on the noticeclosed function. This makes it possible for unauthenticated attackers to dismiss notices via a...

CVE-2023-50053

An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce random number...

CVE-2023-50059

An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe, the signed message lacks a nonce random number...

gnutls: vulnerable to Minerva side-channel information leak

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLSPRIVKEYFLAGREPRODUCIBLE flag, it can result in a noticeable step in nonce...

kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack

A vulnerability was found in Linux Kernel, where Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack. When an attacker connects to a victim device using the address of the device and the victim initiates a Pairing, the attacker can reflect the encrypted nonce even...

CVE-2023-50059

An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe, the signed message lacks a nonce random number...

CVE-2023-50053

An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce random number...

CVE-2023-50059

An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe, the signed message lacks a nonce random number...

CVE-2023-50053: Exposure of Private Personal Information to an Unauthorized Actor

An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce random number...

Podlove Podcast Publisher < 4.0.15 - Cross-Site Request Forgery

Description The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.14. This is due to missing or incorrect nonce validation on the jobcreate and jobdelete functions. This makes it possible for unauthenticated...