CVE-2022-24712

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery CSRF protection mechanism. Users should upgrade to version 4.1.9. There are workarounds for...

PT-2021-22388

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.16.0 Description The issue allows remote attackers to bypass Cross-Site Request Forgery CSRF protection by tricking a user into retrying a request, enabling them to replay a crafted...

CVE-2021-24490

The Email Artillery MASS EMAIL WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well...

CVE-2021-21679

Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2021-21678

Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

Jenkins 安全漏洞

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. Jenkins Azure AD Plugin has a security vulnerability through which an attacker can bypass CSRF protection...

WS-2021-0197

Golf in versions v0.1.1 to v0.2.0 allowing an attacker to bypass CSRF protections which relatively few requests. Related to xsrf.go...

CVE-2021-29435

trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially...

PT-2021-18211

Name of the Vulnerable Software and Affected Versions: trestle-auth versions 0.4.0 through 0.4.1 Description: A vulnerability in trestle-auth allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This...

PT-2021-11735

Name of the Vulnerable Software and Affected Versions: NETGEAR JGS516PE/GS116Ev2 version 2.6.0.43 Description: The issue concerns the CSRF protection mechanism in the web administration panel, which can be bypassed by omitting the CSRF token parameter in HTTP requests. Recommendations: For NETGEA...

CVE-2020-28452

This affects the package com.softwaremill.akka-http-session:core2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core2.11; the package com.softwaremill.akka-http-session:core2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request...

CVE-2020-28452

This affects the package com.softwaremill.akka-http-session:core2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core2.11; the package com.softwaremill.akka-http-session:core2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request...

PT-2021-11534

Name of the Vulnerable Software and Affected Versions: com.softwaremill.akka-http-session:core 2.12 versions 0 through 0.6.1 com.softwaremill.akka-http-session:core 2.11 versions 0 and later com.softwaremill.akka-http-session:core 2.13 versions 0 through 0.6.1 Description: The issue allows CSRF...

PT-2020-14889

exploit 1. CVE-2020-16842: CSRF protection bypass in iTop ITSM & CMDB https://sysdream.com/news/lab/2020-12-14-cve-2020-16842-csrf-protection-bypass-in-itop 2. CVE-2020-17527: Tomcat Information Leak https://bz.apache.org/bugzilla/show bug.cgi?id=64830...

Trend Micro InterScan Web Security Virtual Appliance CSRF Protection Bypass Vulnerability

Trend Micro InterScan Web Security Virtual Appliance IWSVA is a Web security gateway from Trend Micro that provides dynamic, integrated security protection for enterprise networks against Web-based threats. A security vulnerability exists in Trend Micro InterScan Web Security Virtual Appliance 6....

CVE-2020-8461

A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a victim's browser to send a specifically encoded request without requiring a valid CSRF token...

CVE-2020-8461: Cross-Site Request Forgery (CSRF)

A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a victim's browser to send a specifically encoded request without requiring a valid CSRF token...

PT-2020-20149

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance version 6.5 SP2 Description A CSRF protection bypass issue could allow an attacker to trick a victim's browser into sending a specifically encoded request without a valid token...

CVE-2020-7780

This affects the package com.softwaremill.akka-http-session:core2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection...

CVE-2020-7780

This affects the package com.softwaremill.akka-http-session:core2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection...