Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in GROWI v3.4.6 and earlier allows remote attackers to hijack the authentication of administrators via updating user's 'Basic Info'...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in HTML5 Maps 1.6.5.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5983

Cross-site request forgery CSRF vulnerability in HTML5 Maps 1.6.5.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5979

Summary (CVE-2019-5979): A CSRF flaw in the WordPress plugin “Personalized WooCommerce Cart Page” (versions 2.4 and earlier) could allow remote attackers to hijack administrator accounts through unspecified vectors. Public references consistently identify the affected component as the Personalize...

CVE-2019-5960

Cross-site request forgery CSRF vulnerability in WP Open Graph 1.6.1 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

PT-2019-17907 · Unknown · Online Lesson Booking

Name of the Vulnerable Software and Affected Versions: Online Lesson Booking versions 0.8.6 and earlier Description: A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators. Recommendations: For versions 0.8.6 and earlier, update to a version late...

PT-2019-17918 · Unknown · Custom Css Pro

Name of the Vulnerable Software and Affected Versions: Custom CSS Pro versions 1.0.3 and earlier Description: A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators. The attack vectors are not specified. Recommendations: For Custom CSS Pro versio...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page...

CVE-2019-5920

Cross-site request forgery CSRF vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page...

curl: Incorrect reuse of client certificates

It was found that the libcurl library using the NSS Network Security Services library as TLS/SSL backend incorrectly re-used client certificates for subsequent TLS connections in certain cases. An attacker could potentially use this flaw to hijack the authentication of the connection by leveragin...

curl: TLS session resumption client cert bypass

It was found that the libcurl library did not prevent TLS session resumption when the client certificate had changed. An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate...

CVE-2018-15903

The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting XSS. An authenticated attacker will be able to place malicious JavaScript in the discussion forum, which is present in the login landing page. A low privilege user can use this to steal the session cookies...

CVE-2018-0647

Cross-site request forgery CSRF vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2018-0647

Cross-site request forgery CSRF vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Authentication flaw

DISPUTED An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The LAContext class for Biometric TouchID validation allows authentication bypass by overriding the LAContext return Boolean value to be "true" because the kSecAccessControlUserPresence protection mechanism is n...

CVE-2018-12603

Cross-site request forgery CSRF vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114...

CVE-2018-12603

CVE-2018-12603 affects LFCMS 3.7.0: a Cross-Site Request Forgery in admin.php via the s parameter allows remote attackers to hijack user authentication and add an administrator account. The issue enables adding admin accounts without user consent, as described in CVE-2018-12114 related disclosure...

CVE-2018-6563

Multiple cross-site request forgery CSRF vulnerabilities in totemomail Encryption Gateway before 6.0.0Build371 allow remote attackers to hijack the authentication of users for requests that 1 change user settings, 2 send emails, or 3 change contact information by leveraging lack of an anti-CSRF...

Steam, Fire, and Paste – A Story of UXSS via DOM-XSS & Clickjacking in Steam Inventory Helper

Summary The “Steam Inventory Helper” Chrome extension version 1.13.6 suffered from both a DOM-based Cross-site Scripting XSS and a clickjacking vulnerability. By combining these vulnerabilities it is possible to gain JavaScript code execution in the highly-privileged context of the extension’s...

CVE-2015-7610

Cross-site request forgery CSRF vulnerability in the login form in Zimbra Collaboration Suite aka ZCS before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF...