1717 matches found
CVE-2019-15089
An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.1.16 jenkins security update
An update for jenkins is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CVE-2019-14998
The Webwork action Cross-Site Request Forgery CSRF protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection via "cookie tossing" a CSRF cookie from a subdomain of a Jira instance...
CVE-2019-14998
Atlassian Jira versions before 8.4.0 are affected by CVE-2019-14998 due to a CSRF protection bypass in the Webwork CSRF mechanism: an attacker can bypass protection by using a subdomain cookie-tossing technique to trigger CSRF headers. Impact is exposure to CSRF, enabling unauthorized actions on ...
CVE-2019-16059
Sentrifugo 3.2 lacks CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code at index.php/dashboard/viewprofile via a crafted HTML page...
Cross site request forgery (csrf)
Sentrifugo 3.2 lacks CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code at index.php/dashboard/viewprofile via a crafted HTML page...
CVE-2019-16059
Sentrifugo 3.2 lacks CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code at index.php/dashboard/viewprofile via a crafted HTML page...
CVE-2019-16059
CVE-2019-16059 affects Sentrifugo 3.2 and is described across multiple sources (NVD, Red Hat, CVE lists) as lacking CSRF protection, which could allow an attacker to trick an administrator into executing arbitrary code at index.php/dashboard/viewprofile via a crafted HTML page. The connected docu...
October CMS Upload Protection Bypass Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'October CMS Upload Protection Bypass Code Execution', 'Description' = %q This module exploits an Authenticated user with permission to upload and...
Jenkins < 2.192 and < 2.176.3 LTS Multiple Vulnerabilities - Windows
Jenkins is prone to multiple vulnerabilities. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
RHEL 7 : OpenShift Container Platform 4.1 jenkins (RHSA-2019:2548)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2548 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...
Debian DLA-1900-2 : apache2 regression update
The update of apache2 released as DLA-1900-1 contained an incomplete fix for CVE-2019-10092, a limited cross-site scripting issue affecting the modproxy error page. The old patch rather introduced a new CSRF protection which also caused a regression, an inability to dynamically change the status ...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.1 jenkins security update
An update for jenkins is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Cross site request forgery (csrf)
MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page...
CVE-2019-15496
The CVE-2019-15496 entry concerns MyT Project Management 1.5.1, which reportedly lacks CSRF protection and enables a CSRF attack that could trick an administrator into executing arbitrary code via a crafted HTML page. The connected sources confirm the affected product/version and the underlying i...
CVE-2019-15496
MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page...
jenkins -- multiple vulnerabilities
Jenkins Security Advisory: Description Medium SECURITY-1453 / CVE-2019-10383 Stored XSS vulnerability in update center High SECURITY-1491 / CVE-2019-10384 CSRF protection tokens for anonymous users did not expire in some circumstances...
RHEL 7 : OpenShift Container Platform 3.11 jenkins (RHSA-2019:2503)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2503 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...
Important: Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins security update
An update for jenkins is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...