11437 matches found
Tutor Plugin CSRF
The vulnerability of the erasetutordata function in the Tutor plugin of the WordPress content management system is related to the，nonce。， CSRF 。...
CVE-2023-50053
An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce random number...
CVE-2023-50053
The Foundation.app Foundation platform version 1.0 is vulnerable to a security issue in its Message Handler component during the Web3 authentication process . A remote attacker can obtain sensitive information because the signed message lacks a nonce (a required random number). To mitigate this r...
CVE-2023-50059
The Galxe platform version 1.0 is vulnerable to a security flaw in its Web3 authentication process . The root cause is that the signed message lacks a nonce (random number), which enables a Web3 Authentication Replay Attack . A remote attacker can exploit this to obtain sensitive information . As...
WordPress Automatic Plugin CSRF
The vulnerability of the WordPress Automatic Plugin, a content management system for WordPress websites, is related to the of cross-site requests due to incorrect validation of the value of the one-time code nonce. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack...
WordPress Automatic Plugin Privilege Escalation
The vulnerability of the WordPress Automatic Plugin, a content management system for WordPress websites, is related to the falsification of cross-site requests due to incorrect validation of the value of the one-time code nonce. Exploiting this vulnerability can allow a malicious actor to enhance...
SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion
Description The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the deletePricingTable function. This makes it possible for unauthenticated attackers to delete...
Slash Admin < 3.8.2 - Cross-Site Request Forgery
Description The Slash Admin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a...
5280 Bootstrap Modal Contact Form <= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages
Description The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in class-sbmm-list-table.php. This makes it possible for unauthenticated attackers to...
Easy Restaurant Table Booking <= 1.0.0 - Cross-Site Request Forgery
Description The Easy Restaurant Table Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the...
Fedora 40 : filezilla / libfilezilla (2024-ff9a2fb31c)
The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-ff9a2fb31c advisory. Fix for CVE-2024-31497 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.11.1 - Cross-Site Request Forgery to Notice Dismissal
Description The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.0. This is due to missing or incorrect nonce validation on the...
WP ADA Compliance Check Basic – Most Comprehensive Web Accessibility Solution for WordPress < 3.1.4 - Cross-Site Request Forgery
Description The WP ADA Compliance Check Basic – Most Comprehensive Web Accessibility Solution for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.3. This is due to missing or incorrect nonce validation on several functions. This...
Amazon Linux 2023 : gnutls, gnutls-c++, gnutls-dane (ALAS2023-2024-591)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-591 advisory. A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios...
RHEL 7 : firefox (RHSA-2024:1486)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1486 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...
CVE-2024-3052
Malformed S2 Nonce Get command classes can be sent to crash the gateway. A hard reset is required to recover the gateway...
CVE-2024-3052 Z/IP Gateway S2 Nonce Get Denial of Service Vulnerability
Malformed S2 Nonce Get command classes can be sent to crash the gateway. A hard reset is required to recover the gateway...
CVE-2024-3052 Z/IP Gateway S2 Nonce Get Denial of Service Vulnerability
Malformed S2 Nonce Get command classes can be sent to crash the gateway. A hard reset is required to recover the gateway...
CVE-2024-3962
The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files...
