112 matches found
Drupal CMS Code Execution
The vulnerability of the Drupal CMS system is related to insufficient verification of the authenticity of executed queries. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code...
Cross-Site Request Forgery (CSRF)
cfme-gemset is vulnerable to cross-site request forgery CSRF. Lack of authenticity verification of requests in the API notifications allows an attacker to submit requests on behalf of an authenticated user...
Cross-Site Request Forgery (CSRF)
express-cart is vulnerable to cross-site request forgery CSRF. Lack of verification of the authenticity of requests allows an attacker to submit requests on behalf of the user such as creating arbitrary discounts by tricking the user into visiting a malicious web page...
Cisco IOS XE Software IPsec VPN DoS (cisco-sa-iosxe-vpn-dos-edOmW28Z)
According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the hardware crypto driver due to insufficient verification of authenticity of received Encapsulating Security Payload ESP packets. An attacker could exploit this vulnerability by...
Cross-Site Request Forgery (CSRF)
nukeviet/nukeviet is vulnerable to cross site request forgery CSRF. The vulnerability exists as the application is not able to verify the authenticity of requests. An attacker is able to exploit the vulnerability and submit requests on behalf of the user to change profile details and password of...
Cisco WebEx Business Suite Man-in-the-Middle
The vulnerability of the software for Cisco WebEx Business Suite-related web conferencing services is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...
Cisco NX-OS Anycast Data Compromise
The vulnerability in the anycast function of the Cisco NX-OS operating system is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information...
Cisco HyperFlex Statistical Collection Service Data Compromise
The vulnerability of the Cisco HyperFlex hyper-converged infrastructure’s statistical collection service is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...
IcedTea-Web Plugin Arbitrary Code Injection
The vulnerability of the IcedTea-Web plugin is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a remote attacker to inject arbitrary code into the JAR file...
CVE-2019-7323
GUP generic update process in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update. The update process relies on cleartext HTTP. The attacker could replace the...
CVE-2018-7798
A Insufficient Verification of Data Authenticity CWE-345 vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration IP address, mask and gateway when remotely connected to the device...
Cross-Site Request Forgery (CSRF)
tribalsystems/zenario is vulnerable to cross-site request forgery CSRF. The application does not verify the authenticity of a request to admin/organizer.ajax.php?path=zenariocontent%2Fpanels%2Fcontent, which allows an attacker to submit a request on behalf of the victim when the victim visits a...
Design/Logic Flaw
A vulnerability was discovered in all versions of Medtronic MyCareLink 24950 and 24952 Patient Monitor. The affected product's update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable...
Trend Micro Email Encryption Gateway Multiple Vulnerabilities
1. Advisory Information Title: Trend Micro Email Encryption Gateway Multiple Vulnerabilities Advisory ID: CORE-2017-0006 Advisory URL:http://www.coresecurity.com/core-labs/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities Date published: 2018-02-21 Date of last update:...
Kaspersky 8.0 Web Console Command Injection
The vulnerability of the Antivirus Kaspersky 8.0 web console for Linux File Servers arises from the lack of authenticity verification for the creators of the web consoles. Exploiting this vulnerability allows a malicious actor to send an antivirus command on behalf of the user who visits the...
Windows Code Execution
The vulnerability of the Windows Reader component of the Windows operating system is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created Reader file from a remote location...
HackerOne: Substantially weakened authenticity verification when using 'Remember me for a week'
Hello HackerOne, I noticed that in order to access data bound to a user's permissions, say their own bug reports, or CSRF-token, you only need one certain cookie, which is rememberusertoken, and although it is sent when the user uses HackerOne in a normal fashion, the session cookie is ignored an...
Mac OS X : Cisco AnyConnect Secure Mobility Client 2.x / 3.x < 3.0(629) Multiple Vulnerabilities
The remote host has a version of Cisco AnyConnect 2.x or 3.x prior to 3.0629 and is, therefore, affected by the following vulnerabilities : - When the client is obtained from the VPN headend using a web browser, a helper application performs the download and installation. This helper application...
CVE-2012-5003
nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted remote attackers to execute arbitrary code via a crafted 1 SiteUrl or 2 RedirectUrl parameter that points to a Trojan Horse client.zip update file...