1717 matches found
CVE-2018-19135
ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload enabled by default. This can be used by an attacker to perform actions for an admin or any user with the file upload capability. With this vulnerability, one can automatically upload files by default, it allows html, pdf,...
CVE-2018-19135
ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload enabled by default. This can be used by an attacker to perform actions for an admin or any user with the file upload capability. With this vulnerability, one can automatically upload files by default, it allows html, pdf,...
CVE-2018-19135
Summary of CVE-2018-19135 (ClipperCMS 1.3.3): ClipperCMS 1.3.3 is vulnerable to a Cross-Site Request Forgery (CSRF) in the kcfinder file upload feature, which is enabled by default. The vulnerability allows an attacker to perform actions on behalf of an admin (or any user with file upload capabil...
CVE-2018-15438
A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF...
CVE-2018-15539
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc...
Cross site request forgery (csrf)
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc...
CVE-2018-15539
Agentejo Cockpit (Cockpit CMS) is affected by CVE-2018-15539 due to a lack of anti-CSRF protection. Multiple connected sources confirm a CSRF vulnerability that enables unauthorized actions such as changing API tokens and passwords. The CNVD entry explicitly notes a CSRF vulnerability in Cockpit ...
CVE-2018-15539
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc...
Discourse: Account takeover at https://try.discourse.org due to no CSRF protection in connecting Yahoo account
Hi There is an option in https://try.discourse.org/u/testh1ay/preferences/account to connect our Yahoo account. I noticed Connect Yahoo account option have the workflow with GET method and there is lack of csrf protection on connecting yahoo account which can help attacker into inducing victim to...
Cockpit CMS CSRF / XSS / Path Traversal Vulnerabilities
Cockpit CMS suffers from cross site request forgery, cross site scripting, and traversal vulnerabilities. Version 0.6.2 should address these issues. 1 Path Traversal CVE-2018-15540 It is possible to read/write/delete files or list directories by using "../" to traverse to other folders via reques...
Cockpit CMS CSRF / XSS / Path Traversal
1 Path Traversal CVE-2018-15540 It is possible to read/write/delete files or list directories by using "../" to traverse to other folders via requests to /cockpit/media/api Example of a vulnerable request: POST /cockpit/media/api HTTP/1.1 Host: 192.168.5.129 User-Agent: Mozilla/5.0 Windows NT 10....
CVE-2018-12456
Vulnerability summary (CVE-2018-12456): Intelbras NPLUG 1.0.0.14 wireless repeater web interface lacks CSRF token protection, enabling a CSRF-based attack that can modify the SSID, reboot the device, edit the access control list, or activate remote access. The CNVD entry confirms the CSRF vulnera...
Cross site request forgery (csrf)
SAP Fiori 1.0 for SAP ERP HCM Approve Leave Request, version 2 application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection...
CVE-2018-2474
SAP Fiori 1.0 for SAP ERP HCM Approve Leave Request, version 2 application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection...
Shopify: H1514 Stored XSS in Return Magic App portal content
Summary: Stored XSS vulnerability was found in return magic app portal content which executes in the application domain in https://services.alveo.io/dashboard-shopify/settings/portal/content Description: It's been found that Return Magic app allows users to add HTML content to their return portal...
Cross site request forgery (csrf)
DASAN H660GW devices do not implement any CSRF protection mechanism...
CVE-2018-17869
DASAN H660GW devices do not implement any CSRF protection mechanism...
Cross site scripting
A Reflected Cross-Site Scripting XSS vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability...
CVE-2018-15365
A Reflected Cross-Site Scripting XSS vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability...