CVE-2019-15779

The CVE-2019-15779 entry concerns the WordPress insta-gallery plugin prior to version 2.4.8, which has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete. Consequence per sources indicates lack of CSRF/authorization checks could allow unauthorized actions, including potential ...

PT-2019-14388

Name of the Vulnerable Software and Affected Versions insta-gallery plugin versions prior to 2.4.8 Description The issue concerns the lack of nonce validation for certain actions. Specifically, it affects the qligg dismiss notice and qligg form item delete actions, which can be exploited due to t...

CVE-2018-20231: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfaenabletfa parameter due to missing nonce validation...

PT-2018-15298

Name of the Vulnerable Software and Affected Versions WordPress two-factor-authentication plugin versions prior to 1.3.13 Description The issue allows remote attackers to disable two-factor authentication 2FA due to missing nonce validation. This can be achieved by exploiting the tfa enable tfa...

W3 Total Cache <= 0.9.4.1 – Unauthenticated Security Token Bypass

The /pub/apc.php file is used to empty the OPCache/APC. The script seems protected by a nonce aka security token: $nonce = W3Request::getstring'nonce'; $uri = $SERVER'REQUESTURI'; if wphash$uri == $nonce But the flaw stays in the == operator which is not the one to use when you want to compare...

tomcat: three DIGEST authentication implementation issues

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended...