WAVLINK WN531G3 跨站请求伪造漏洞

The WAVLINK WN531G3 is a wireless router from China-based RuiYin Technology WAVLINK. A security vulnerability exists in WAVLINK WN531G3 firmware version M31G3.V5030.200325 and prior versions, which stems from the non-use of anti-CSRF tokens, and when used in conjunction with other issues such as...

CVE-2021-45886

An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user such as operator can be used to confirm actions of higher-privileged ones such...

CVE-2021-45886

An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user such as operator can be used to confirm actions of higher-privileged ones such...

Cross site request forgery (csrf)

An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user such as operator can be used to confirm actions of higher-privileged ones such...

CVE-2021-45886

An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user such as operator can be used to confirm actions of higher-privileged ones such...

CVE-2021-45886

CVE-2021-45886 concerns PONTON X/P Messenger before 3.11.2. The flaw is that anti-CSRF tokens are globally valid, creating a weakened CSRF condition where an arbitrary token from a low-privilege user (e.g., operator) can be used to confirm actions of a higher-privilege user (e.g., xpadmin). The p...

CVE-2021-45886: Cross-Site Request Forgery (CSRF)

An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user such as operator can be used to confirm actions of higher-privileged ones such...

PT-2022-12449

Name of the Vulnerable Software and Affected Versions PONTON X/P Messenger versions prior to 3.11.2 Description An issue was discovered where anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF. This allows an arbitrary token of a low-privilege...

CVE-2021-20862

Improper access control vulnerability in ELECOM routers WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior,...

Improper access control

Improper access control vulnerability in ELECOM routers WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior,...

CVE-2021-20862

Improper access control vulnerability in ELECOM routers WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior,...

PT-2021-14305

Name of the Vulnerable Software and Affected Versions: ELECOM WRC-1167GST2 firmware versions 1.25 and prior ELECOM WRC-1167GST2A firmware versions 1.25 and prior ELECOM WRC-1167GST2H firmware versions 1.25 and prior ELECOM WRC-2533GS2-B firmware versions 1.52 and prior ELECOM WRC-2533GS2-W firmwa...

CVE-2021-20862: Undefined Security Weakness

Improper access control vulnerability in ELECOM routers WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior,...

PEEL-CSRF

The request appears to be vulnerable to cross-site request forgery CSRF attacks against unauthenticated functionality. This is unlikely to constitute a security vulnerability in its own right, however, it may facilitate the exploitation of other vulnerabilities affecting application users. The...

EPSON EPS TSE Server Cross-Site Request Forgery Vulnerability

EPSON EPS TSE Server is a server from EPSON Japan. EPSON EPS TSE Server 8 suffers from a cross-site request forgery vulnerability that stems from a lack of anti-csrf tokens throughout the administration interface, allowing an unauthenticated attacker to exploit the vulnerability by visiting a...

Cross-Site Request Forgery (CSRF)

genix/cms is vulnerable to cross-site request forgery CSRF. An improper fix to a previous vulnerability CVE-2015-2680 allows an attacker with any valid anti-CSRF tokens to perform a CSRF attack on another user and submit requests on behalf of the user...

Cross-Site Request Forgery (CSRF)

drill-yarn is vulnerable to cross-site request forgery CSRF. Lack of anti-CSRF tokens usage and validation prevented the server from verifying the authenticity of web requests, which would allow for remote attackers to submit requests on behalf of the authenticated users when they are tricked int...

U.S. Dept Of Defense: [████████] — XSS on `/███████_flight/images` via `advanced_val` parameter

Description POST parameter advancedval is vulnerable to reflected XSS on endpoint https://███/██████████flight/images. XSS affects all users and no authentication or login is required. Proof of Concept Either visit the following URL for PoC: https://██████████/poc/ Or, create your own PoC file:...

Cross-Site Request Forgery (CSRF)

flarum/core is vulnerable to cross-site request forgery CSRF. The application was not able to determine the authenticity and origin of requests received due to a lack of anti-CSRF tokens. This allows remote attackers to submit unwanted requests on behalf of users when the users are tricked into...

PT-2019-11607

Name of the Vulnerable Software and Affected Versions: CloudForms versions 5.9 through 5.10 Description: A stored cross-site scripting XSS issue was discovered in the PDF export component due to improper sanitization of user input. This allows an attacker with minimal privileges to execute a XSS...