CVE-2024-10020

The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log i...

Security Advisory 0105

Security Advisory 0105 PDF Date: October 29, 2024 Revision | Date | Changes ---|---|--- 1.0 | October 29, 2024 | Initial release Description Multiple vulnerabilities exist for the Arista Edge Threat Management - Arista NG Firewall NGFW: 1 Description : A user with administrator privileges can...

CVE-2024-29009

Cross-site request forgery CSRF vulnerability in easy-popup-show all versions allows a remote unauthenticated attacker to hijack the authentication of the administrator and to perform unintended operations if the administrator views a malicious page while logged in...

CVE-2024-29009

Cross-site request forgery CSRF vulnerability in easy-popup-show all versions allows a remote unauthenticated attacker to hijack the authentication of the administrator and to perform unintended operations if the administrator views a malicious page while logged in...

MikroTik RouterOS Cross-Site Request Forgery (CVE-2015-2350)

Cross-site request forgery CSRF vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg. This plugin only works with Tenable.ot. Please...

Anyone can permanently disable the token guardian for their wallet by calling this one DANGER__disableTokenGuardian function

Lines of code Vulnerability details Impact A hacker could call DANGERdisableTokenGuardian, instantly disable the guardian and steal tokens or make malicious approvals Proof of Concept The DANGERdisableTokenGuardian function is risky and should be reconsidered. The main issue is that it allows...

PT-2023-19280 · WordPress · David Gwyer Wp Content Filter

Name of the Vulnerable Software and Affected Versions: David Gwyer WP Content Filter plugin versions 3.0.1 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For David Gwyer WP...

CVE-2023-25059

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in avalex GmbH avalex – Automatically secure legal texts plugin = 3.0.3 versions...

Vulnerabilities fixed in Zimbra Collaboration

Zimbra has fixed vulnerabilities in Zimbra Collaboration. A malicious party could exploit the vulnerabilities to use a Cross-site scripting attack to gain access to sensitive data, or to execute arbitrary code on the system. To execute arbitrary code, the malicious party needs prior authenticatio...

The vulnerability of the authentication mechanism for software administrators of the ImageCast X device for marking ballots allows a perpetrator to escalate their privileges.

The vulnerability of the authentication mechanism for software administrators of the ImageCast X labeling device is related to privilege assignment errors. Exploiting this vulnerability can allow attackers to enhance their privileges...

Online Student Rate System Access Control Error Vulnerability

Online Student Rate System is an online grading system for students. An Access Control Error vulnerability exists in Online Student Rate System v1.0, which arises from improper access control and can be exploited by any attacker to register as an administrator without authentication...

CVE-2022-29877

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in RebooterWATCH BOOT nino RPC-M2C End of Sale all firmware versions, WATCH BOOT light RPC-M5C End of Sale all firmware versions, WATCH BOOT L-zero RPC-M4L End of Sale all firmware versions, WATCH BOOT mini RPC-M4H End of Sale all firmware versions,...

CVE-2022-27632

Cross-site request forgery CSRF vulnerability in RebooterWATCH BOOT nino RPC-M2C End of Sale all firmware versions, WATCH BOOT light RPC-M5C End of Sale all firmware versions, WATCH BOOT L-zero RPC-M4L End of Sale all firmware versions, WATCH BOOT mini RPC-M4H End of Sale all firmware versions,...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 for EC-CUBE 4 series and ver1.0.0 to 1.0.4 for EC-CUBE 3 series allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted pag...

CVE-2022-21179

Cross-site request forgery CSRF vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 for EC-CUBE 4 series and ver1.0.0 to 1.0.4 for EC-CUBE 3 series allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted pag...

elecom lan routers cross-site request forgery vulnerability

elecom lan routers is a router from Elecom Japan. A cross-site request forgery vulnerability exists in elecom lan routers, which can be exploited by an attacker to hijack administrator authentication via a specially crafted page...

CVE-2021-20845

Cross-site request forgery CSRF vulnerability in Unlimited Sitemap Generator versions prior to v8.2 allows a remote attacker to hijack the authentication of an administrator and conduct arbitrary operation via a specially crafted web page...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...

Cybozu Remote Service Cross-Site Request Forgery Vulnerability

A cross-site request forgery vulnerability exists in the Cybozu Remote Service management interface. A remote attacker can use this vulnerability to hijack the administrator's authentication and perform unintended actions...