Cross site request forgery (csrf)

OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protection...

openSUSE Security Update : cups (openSUSE-2019-991)

This update for cups fixes the following issues : Security issue fixed : - CVE-2018-4700: Fixed extremely predictable cookie generation that is effectively breaking the CSRF protection of the CUPS web interface bsc1115750. This update was imported from the SUSE:SLE-15:Update update project...

CVE-2019-9787

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

CVE-2019-9787

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

WordPress Forminator Plugin CVE-2019-9567

Description Custom fields of a poll are not properly encoded when showing results of a poll, leading to persistent XSS. Successful exploitation allows an unauthenticated attacker to execute JavaScript in the context of the application in the name of an attacked user. This in turn enables an...

CVE-2019-1658 Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF...

CSRF Bypass

cfme is vulnerable to CSRF bypass attacks. The vulnerability exists as a number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protectfromforgery CSRF protection...

Shopify: Reflected XSS in *.myshopify.com/account/register

Shopify allows shop admin to enable customer registration. When a customer registers with a short password and HTML content as the first name and last name then customer redirects to .myshopify.com/account/register with error messages and the provided data. As there is no Cross-site Scripting...

openSUSE: Security Advisory for cups (openSUSE-SU-2018:4141-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for cups (openSUSE-SU-2018:4141-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : cups (openSUSE-2018-1555)

This update for cups fixes the following security issue : - CVE-2018-4700: Fixed extremely predictable cookie generation that is effectively breaking the CSRF protection of the CUPS web interface bsc1115750. This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 ...

Rockstar Games: Account Takeover using Linked Accounts due to lack of CSRF protection

In this report, the researcher found a weakness in our third-party account linking process. They were able to create a malicious link that, if clicked by the victim, would under certain conditions give the attacker access to the victim's Social Club account. This issue has now been fixed...

Security update for cups (important)

This update for cups fixes the following security issue: - CVE-2018-4700: Fixed extremely predictable cookie generation that is effectively breaking the CSRF protection of the CUPS web interface bsc1115750. This update was imported from the SUSE:SLE-12:Update update project...

Security update for cups (important)

This update for cups fixes the following issues: Security issue fixed: - CVE-2018-4700: Fixed extremely predictable cookie generation that is effectively breaking the CSRF protection of the CUPS web interface bsc1115750. This update was imported from the SUSE:SLE-15:Update update project...

openSUSE Security Update : cups (openSUSE-2018-1539)

This update for cups fixes the following issues : Security issue fixed : - CVE-2018-4700: Fixed extremely predictable cookie generation that is effectively breaking the CSRF protection of the CUPS web interface bsc1115750. This update was imported from the SUSE:SLE-15:Update update project...

SUSE SLED12 / SLES12 Security Update : cups (SUSE-SU-2018:4089-1)

This update for cups fixes the following issues : Security issue fixed : CVE-2018-4700: Fixed extremely predictable cookie generation that is effectively breaking the CSRF protection of the CUPS web interface bsc1115750. Note that Tenable Network Security has extracted the preceding description...

openSUSE: Security Advisory for cups (openSUSE-SU-2018:4105-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2018:4089-1 Security update for cups

This update for cups fixes the following issues: Security issue fixed: - CVE-2018-4700: Fixed extremely predictable cookie generation that is effectively breaking the CSRF protection of the CUPS web interface bsc1115750...

SUSE-SU-2018:4059-1 Security update for cups

This update for cups fixes the following issues: Security issue fixed: - CVE-2018-4700: Fixed extremely predictable cookie generation that is effectively breaking the CSRF protection of the CUPS web interface bsc1115750...

Design/Logic Flaw

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload enabled by default. This can be used by an attacker to perform actions for an admin or any user with the file upload capability. With this vulnerability, one can automatically upload files by default, it allows html, pdf,...