CVE-2023-4247 GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givesendwpdisconnect function. This makes it possible for unauthenticated attackers to deactivate the SendWP plugin via...

CVE-2023-4247: Cross-Site Request Forgery (CSRF)

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givesendwpdisconnect function. This makes it possible for unauthenticated attackers to deactivate the SendWP plugin via...

Martins Free & Easy SEO Link buildings < 1.2.30 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in amin open...

CVE-2023-46249 authentik potential installation takeover when default admin user is deleted

authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the...

CVE-2023-5194

Mattermost contains an Incorrect Authorization vulnerability (CVE-2023-5194) where permissions are not properly validated when demoting and deactivating a user. This lets a system/user manager demote or deactivate another manager. Affected versions include Mattermost Server prior to 7.8.10 and 8....

CVE-2023-5194: Incorrect Authorization

Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager...

OESA-2023-1636 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2SESSIONSETUP commands. The issue results from the lack of control of resource consumption...

CVE-2023-40868

Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions...

CVE-2023-40868

Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions...

Cross site request forgery (csrf)

Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions...

CVE-2023-40868

Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions...

CVE-2023-40868: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions...

CVE-2023-40868

Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions...

mooSocial Cross-Site Request Forgery Vulnerability

mooSocial is a multi-platform, mobile-ready, user-friendly script from mooSocial, Inc. for building community-driven content sharing and social networking sites. A cross-site request forgery vulnerability exists in the mooSocial v.Demo version, which stems from a vulnerability that could allow a...

CVE-2023-40868

CVE-2023-40868 affects mooSocial MooSocial Software v.Demo. It describes a Cross-Site Request Forgery that could allow a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions. Remediation in some sources suggests temporarily disabling these functions until a pa...

WooCommerce Subscriptions < 4.6.0 - Subscription Suspension/Activation via CSRF

Description The plugin does not have CSRF check when suspending and activating subscriptions, which could allow attackers to make a logged in admin suspend or activate arbitrary subscription via a CSRF attack Deactivate subscription with ID 53:...

Total stake will be incorrectly reduced if the transcoder was already deactivated.

Lines of code Vulnerability details Impact This will result in the total active stake being incorrectly calculated in future rounds. Some transcoders may get more or less rewards than they should. Proof of Concept The key functions involved are: slashTranscoder - Called to slash a transcoder...

SUSE CVE-2023-4569

A memory leak flaw was found in nftsetcatchallflush in net/netfilter/nftablesapi.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak...

AZL-28545 CVE-2023-4569 affecting package kernel for versions less than 5.15.131.1-2

A memory leak flaw was found in nftsetcatchallflush in net/netfilter/nftablesapi.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak...

The vulnerability of the nft_immediate_deactivate() function in the net/netfilter/nft_immediate.c file of the netfilter network interface layer in the Linux operating system allows a hacker to trigger a service failure or exert other effects.

The vulnerability of the nftimmediatedeactivate function in the net/netfilter/nftimmediate.c file of the netfilter network interface layer in the Linux operating system is related to improper handling during rule creation. Exploiting this vulnerability could allow an attacker to cause service...