CVE-2024-5284

The CVE-2024-5284 entry concerns the WordPress plugin wp-affiliate-platform prior to 6.5.1, which is reported to lack CSRF checks in some areas and to have insufficient sanitisation/escaping. This could enable a logged-in administrator to trigger a Stored XSS payload via CSRF. Red Hat confirms th...

PT-2024-34406 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.6.6 Description: The issue concerns the lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unintended actions through CSRF attacks...

CVE-2024-6022

The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-1375 Event post <= 5.9.10 - Cross-Site Request Forgery

The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing nonce check on the savebulkdatas function in all versions up to, and including, 5.9.10. This makes it possible for unauthenticated attackers to update postmetadata via a forged request, granted...

CVE-2024-1845

The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

MediaWiki Security Breach

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki versions prior to 1.42.1, which stems from a...

CVE-2024-2233

Affected software/impact: Himer WordPress theme prior to 2.1.1 contains CSRF vulnerabilities in group-management actions (e.g., declining/accepting invitations, leaving a group). The root cause is missing CSRF checks in certain areas, enabling logged-in users to be targeted via CSRF attacks. Vers...

CVE-2024-5767

The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-37763

MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can view compiled forms results...

WordPress plugins "WP Tweet Walls" and "Sola Testimonials" vulnerable to cross-site request forgery

Overview WordPress plugins "WP Tweet Walls" and "Sola Testimonials" provided by Sola Plugins contain a cross-site request forgery vulnerability CWE-352. These vulnerabilities are reported by the following reporters, and JPCERT/CC coordinated with the developer under Information Security Early...

CVE-2024-38952

CVE-2024-38952 : PX4-Autopilot v1.14.3 has a buffer overflow in the logger component via the topic_name parameter in /logger/logged_topics.cpp. The CVSS 3.1 vector indicates exploitability is NETWORK, with no privileges or user interaction required, and an impact on availability only (I/N; A:H). ...

CVE-2024-4475

The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check when clearing logs, which could allow attackers to make a logged in admin clear the logs them via a CSRF attack...

CVE-2024-4751

The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-3965

The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

PT-2024-28647 · WordPress · Similarity

Name of the Vulnerable Software and Affected Versions: Similarity WordPress plugin versions prior to 3.1 Description: The issue is related to the lack of a CSRF check when resetting settings in the plugin, which could allow attackers to make a logged-in admin reset them via a CSRF attack...

WordPress plugin Similarity security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

MyFinances Security Vulnerabilities

MyFinances is an open source web application from TreyWW Open Source. Designed to enable individuals and teams to manage their finances effectively. A security vulnerability exists in versions of MyFinances prior to 0.4.6 that stems from a method to access other customer invoices while logged in ...

CVE-2024-38284

Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicate calls...

CVE-2024-38284

CVE-2024-38284 affects Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600), with versions up to 3.1.171.9. The root cause is that transmitted data is logged between the device and the backend, enabling an attacker to perform a replay attack to replicate calls. In the ICS context, mitiga...

Motorola Solutions Vigilant Fixed LPR Coms Box Security Vulnerability

Motorola Solutions Vigilant Fixed LPR Coms Box is a license plate recognition system from Motorola Solutions USA. A security vulnerability exists in Motorola Solutions Vigilant Fixed LPR Coms Box version 3.1.171.9 and prior versions, which stems from the fact that data transmitted between the...