Disable WordPress Update Notifications <= 2.3.3 - Cross-Site Request Forgery

The plugin does not adequately verify requests use nonces, leading to potential CSRF vulnerabilities...

CVE-2020-36721

The Brilliance = 1.2.7, Activello = 1.4.0, and Newspaper X = 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activelloactivateplugin' and 'activellodeactivateplugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing...

CVE-2020-36721

The Brilliance = 1.2.7, Activello = 1.4.0, and Newspaper X = 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activelloactivateplugin' and 'activellodeactivateplugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing...

Authorization

The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This issue exists in versions up to, and including, 1.6.6. This makes it possible for unauthenticated...

PT-2023-11863 · Activello +1 · Activello +2

Name of the Vulnerable Software and Affected Versions: The Brilliance versions prior to 1.2.8 Activello versions prior to 1.4.1 Newspaper X versions prior to 1.3.2 Description: The issue is related to the lack of capability and security checks/nonces in the activello activate plugin and activello...

PT-2023-12481 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions prior to 1.6.7 Description: The issue allows unauthorized access to most actions and endpoints, as they are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This...

Download < 1.1.0 - Cross-Site Request Forgery

The plugin does not properly validate and verify user requests use nonces, making it susceptible to Cross-Site Request Forgery CSRF attacks...

Active Directory Integration < 4.1.5 - SQL Injection via CSRF

The plugin does not properly verify nonces and sufficiently escape user-supplied parameters, leading to Cross-Site Request Forgery and time-based SQL Injection vulnerabilities via the orderby and order parameters...

Comments Ratings < 1.1.7 - Cross-Site Request Forgery

The plugin does not properly validate requests use nonces, leading to a potential Cross-Site Request Forgery vulnerability...

PixTypes < 1.4.15 - Cross-Site Request Forgery

The plugin does not adequately verify requests use nonces, leading to a potential Cross-Site Request Forgery CSRF vulnerability...

CVE-2023-1343

The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the attachrule function. This makes it possible for unauthenticated attackers to modify the...

PT-2023-16734 · WordPress · Download Read More Excerpt Link

Name of the Vulnerable Software and Affected Versions: Download Read More Excerpt Link plugin for WordPress versions up to, and including, 1.6.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the read more excerpt link menu options...

K15295: OpenSSL vulnerability CVE-2014-0076

Security Advisory Description The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack. CVE-2014-0076 Impact...

SUSE CVE-2014-0076

The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack...

SUSE CVE-2014-7203

libzmq aka ZeroMQ/C++ 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors...

Siemens SCALANCE X-300 Switches Use of Insufficiently Random Values (CVE-2022-25752)

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

MediaWiki 安全特征问题漏洞

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy in-house knowledge management and content management systems.CheckUser extension is one of the user information checking extensions. A security feature issue...

CVE-2022-46353

A vulnerability has been identified in SCALANCE X204RNA HSR All versions V3.2.7, SCALANCE X204RNA PRP All versions V3.2.7, SCALANCE X204RNA EEC HSR All versions V3.2.7, SCALANCE X204RNA EEC PRP All versions V3.2.7, SCALANCE X204RNA EEC PRP/HSR All versions V3.2.7. The webserver of affected device...

CVE-2022-3097

The Plugin LBstopattack WordPress plugin before 1.1.3 does not use nonces when saving its settings, making it possible for attackers to conduct CSRF attacks. This could allow attackers to disable the plugin's protections...

PT-2022-20426 · WordPress · Lbstopattack

Name of the Vulnerable Software and Affected Versions: Plugin LBstopattack WordPress plugin versions prior to 1.1.3 Description: The issue allows attackers to conduct CSRF attacks because the plugin does not use nonces when saving its settings. This could enable attackers to disable the plugin's...