Dhabaleshwar Das

An authentication bypass exists when the SAML 2.0 authentication method is enabled. The application treats SAML signature verification as optional and skips required validation steps, allowing an attacker to forge an arbitrary SAML assertion to achieve full session takeover without credentials. This is achieved via a single crafted POST request to the SAML assertion consumer service endpoint.

The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows Cross Site Request Forgery.

Name of the Vulnerable Software and Affected Versions: Chat2 versions prior to 3.6.3 Description: The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability, which allows unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 3.6.3, update to a version that includes the fix for this issue. As a temporary workaround, consider implementing additional validation for requests to prevent unauthorized actions.

Name of the Vulnerable Software and Affected Versions: REVE Chat versions n/a through 6.2.2 Description: The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability and Stored XSS in REVE Chat. Recommendations: For versions n/a through 6.2.2, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to sensitive features that may be exploited through CSRF or Stored XSS attacks until a patch is available.

Name of the Vulnerable Software and Affected Versions: WordPress Events Calendar Plugin – connectDaily versions 1.4.8 and earlier Description: The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability that also allows Cross-Site Scripting (XSS) in the WordPress Events Calendar Plugin – connectDaily. Recommendations: For WordPress Events Calendar Plugin – connectDaily versions 1.4.8 and earlier, update to a version that contains a fix for this issue.

The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels.

The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels.

The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into performing unintended actions on the web application.

The issue is related to a Cross-Site Request Forgery (CSRF) problem, which allows for Cross-Site Request Forgery.

The issue is related to a Cross-Site Request Forgery (CSRF) problem, which allows for Cross Site Request Forgery. This is a type of attack where an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'estatebud settings' page. This allows unauthenticated attackers to update the plugin's settings via a forged request if they can trick a site administrator into performing a specific action, such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'rma-settings-wizard'. This allows unauthenticated attackers to update the plugin's API key via a forged request if they can trick a site administrator into performing a specific action.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `save exam setting` and `delete exam setting` actions. This allows unauthenticated attackers to update exam settings by tricking a site administrator into performing an action, such as clicking on a link, via a forged request.

The issue is due to missing or incorrect nonce validation on the `speedsize clear css cache action` function, making it possible for unauthenticated attackers to clear the plugin's cache via a forged request. This can be achieved if the attackers can trick a site administrator into performing an action, such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `wprequal reset defaults` action. This allows unauthenticated attackers to reset the plugin's settings by tricking a site administrator into performing an action, such as clicking on a link.

The issue is due to missing or incorrect nonce validation on the `deleteexport` action, making it possible for unauthenticated attackers to delete property feed exports via a forged request. This can be achieved by tricking a site administrator into performing an action, such as clicking on a link.

The issue affects the access control security levels in VikBooking Hotel Booking Engine & PMS, allowing exploitation due to incorrectly configured security levels. This is related to a Missing Authorization vulnerability.

The issue is due to missing or incorrect nonce validation on the `linear-debug` feature, making it possible for unauthenticated attackers to reset the plugin's cache via a forged request if they can trick a site administrator into performing a specific action, such as clicking on a link.

A Cross-Site Request Forgery (CSRF) issue affects the software, allowing unauthorized actions to be performed on behalf of a user.

The issue is due to missing or incorrect nonce validation on the 'automate hub' page, making it possible for unauthenticated attackers to update an activation status via a forged request if they can trick a site administrator into performing an action such as clicking on a link. This allows attackers to manipulate site settings without authorization.