Debian : Security Vulnerabilities, CVEs, Published In 2014 (CSRF) CVSS score >= 6
wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.
Max CVSS
6.8
EPSS Score
0.15%
Published
2014-08-18
Updated
2015-11-25
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
Max CVSS
6.8
EPSS Score
0.45%
Published
2014-04-23
Updated
2018-12-13
2 vulnerabilities found