RHEL 6 : krb5 (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - krb5: Automatic sec context deletion could lead to double-free CVE-2017-11462 - The kadm5randkeyprincipal...

Shield Security – Smart Bot Blocking & Intrusion Prevention Security < 19.1.11 - Cross-Site Request Forgery

Description The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19.1.13. This is due to missing or incorrect nonce validation on the exec function. This makes it possible fo...

CVE-2024-3945

The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodomanage function. This makes it possible for unauthenticated attackers to add new todo items via a forged...

CVE-2024-3947

The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodosettings function. This makes it possible for unauthenticated attackers to modify the plugin's settings via ...

CVE-2024-3943

CVE-2024-3943 affects the WordPress plugin WP To Do (versions ≤ 1.3.0). The issue is a Cross-Site Request Forgery (CSRF) vulnerability arising from missing or improper nonce validation on the function wptodo_addcomment, enabling unauthenticated attackers to add comments to to-do items via forged ...

PT-2024-28510 · WordPress · Wp To Do

Name of the Vulnerable Software and Affected Versions: WP To Do plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wptodo settings function. This allows unauthenticated...

PT-2024-28501 · WordPress · Wp To Do

Name of the Vulnerable Software and Affected Versions: WP To Do plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is due to missing or incorrect nonce validation on the wptodo manage function, making it possible for unauthenticated attackers to add new todo items vi...

CVE-2024-34454

Nintendo Wii U OS 5.5.5 allows man-in-the-middle attackers to forge SSL certificates as though they came from a Root CA, because there is a secondary verification mechanism that only checks whether a CA is known and ignores the CA details and signature and because is accepted as a Common Name...

PT-2024-30942 · WordPress · Wp-Vipergb

Name of the Vulnerable Software and Affected Versions: WP-ViperGB plugin for WordPress versions up to, and including, 1.6.1 Description: The issue is due to missing or incorrect nonce validation when saving plugin settings, making it possible for unauthenticated attackers to change the plugin's...

dnspython: denial of service in stub resolver

The dnspython stub resolver is vulnerable to a denial of service DoS risk if an attacker sends a malicious response forged with the correct address and port before a legitimate one arrives on the UDP port used by dnspython for the query. In such cases, dnspython could either switch to another...

PT-2024-33706 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server affected versions not specified Description: The issue affects instances with SAML SSO and encrypted assertions, allowing an attacker to forge a SAML response and gain admin privileges and unrestricted access to the...

The vulnerability of the displaySettings function in the Cacti network monitoring software allows a hacker to execute cross-site scripting.

The vulnerability of the displaySettings function in the Cacti network monitoring software relates to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow a malicious actor to execute cross-site scripting using forged cookie files...

VulnCheck KEV: CVE-2021-40655

D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page...

CVE-2024-1230

The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorrect nonce validation on the maybedisconnectsimpleshop function. This makes it possible for unauthenticated attackers to disconnect the site...

sshpiper Data Forgery Issue Vulnerability

sshpiper is a reverse proxy for sshd by Boshi Lian Personal Developers. A data forgery vulnerability exists in sshpiper 1.0.50 and earlier versions, which stems from the way the proxy protocol listener is implemented that may allow an attacker to forge its connection address...

CVE-2024-4463 Squelch Tabs and Accordions Shortcodes <= 0.4.7 - Cross-Site Request Forgery

The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.7. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to modify...

CVE-2024-4463

CVE-2024-4463 affects the Squelch Tabs and Accordions Shortcodes WordPress plugin. The issue is a Cross-Site Request Forgery (CSRF) due to missing/incorrect nonce validation when saving plugin settings, allowing unauthenticated attackers to modify settings by tricking a site administrator into pe...

CVE-2024-4314

CVE-2024-4314 affects the Hostel WordPress plugin up through version 1.1.5.3, where CSRF exists due to missing/incorrect nonce validation in room management. This allows unauthenticated attackers to trigger actions (e.g., create or delete rooms) by enticing an admin to click a crafted link. The C...

hostel < 1.1.5.4 - Cross-Site Request Forgery

Description The Hostel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5.3. This is due to missing or incorrect nonce validation when managing rooms. This makes it possible for unauthenticated attackers to create and delete rooms via a...

The vulnerability of the digital signature and XML encryption library for Node.js’ xml-crypto, related to improper verification of cryptographic signatures, allows attackers to forge digital signatures.

The vulnerability of the digital signature and encryption library for Node.js’ xml-crypto is related to improper validation of the cryptographic signature. Exploiting this vulnerability allows a malicious actor to forge digital signatures by inserting a newly created, specially crafted signature...