Chaturbate: Missing CSRF Protection in /stats EndPoint.

EndPoint /affiliates/stats. doesnot verify the CSRF Tokens Steps To Reproduce: 1. Login with the your account 2. Navigate to the URL https://chaturbate.com/affiliates/stats.. 3. Check the stats in default its todays date or this week in select period. 4. Intercept the request and change the...

CVE-2018-16952

The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. The impact is sensitive actions in the portal such as changing a portal user's password. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle...

GHSA-2HXV-MX8X-MCJ9 Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability

Cross-site request forgery CSRF vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75. Spina::ApplicationController actions didn't have CSRF protection. This causes a CSRF vulnerability across the entire engine which includes administrative functionality such as creating...

CVE-2013-7464

The CVE-2013-7464 issue affects csrf-magic prior to 1.0.4. If $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token is predictable because an automatically generated secret is not used, allowing CSRF protection bypass. Documents indicate the vulnerability path is within csrf-magic’s t...

Symfony <= 2.7.37, 2.8.x <= 2.8.30, 3.x <= 3.2.13 and 3.3.x <= 3.3.12 Multiple Vulnerabilities

Symfony is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sensiolabs:symfony"; ifdescription...

CVE-2017-16653

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony Version =2 does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in ...

CVE-2017-16653

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony Version =2 does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in ...

CVE-2017-16653

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony Version =2 does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in ...

GHSA-H95J-H2RV-QRG4 Django Cross-Site Request Forgery vulnerability

The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page...

GHSA-M242-WC86-8768 python-fedora vulnerable to an open redirect resulting in loss of CSRF protection

python-fedora 0.8.0 and lower is vulnerable to an open redirect, resulting in loss of CSRF protection...

python-fedora vulnerable to an open redirect resulting in loss of CSRF protection

python-fedora 0.8.0 and lower is vulnerable to an open redirect, resulting in loss of CSRF protection...

Pornhub: Stored XSS in galleries - https://www.redtube.com/gallery/[id] path

Researcher successfully closed the image 'alt' attribute and injected javascript by intercepting the album creation request and submitting an XSS payload as the album title. This led to stored cross-site scripting on the user's album page, executed against any users who visited the album. Stored...

Pornhub: Stored XSS on the https://www.redtube.com/users/[profile]/collections

Researcher successfully closed the image 'alt' attribute and injected javascript by submitting an XSS payload as the collection title. This led to stored cross-site scripting on the user's collections page, executed against any users who visited the user's collections. The user's favorites page w...

CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials

A form action method in GitHub Plugin did not check the permission of the user accessing it, allowing anyone with Overall/Read access to Jenkins to cause Jenkins to send a GitHub API request to create an API token to an attacker-specified URL. This allowed users with Overall/Read access to Jenkin...

Cross site request forgery (csrf)

SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrftoken parameter...

CVE-2018-12659

CVE-2018-12659 affects SLiMS 8 Akasia 8.3.1. The issue is a CSRF protection bypass where an attacker can obtain administrator access by omitting the csrf_token parameter. The root cause is the failure to enforce CSRF token verification, allowing remote exploitation. Documented impacts include adm...

Cross site request forgery (csrf)

In the Open Build Service OBS before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent...

CVE-2014-0594 CSRF protection incorrectly disabled

In the Open Build Service OBS before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent...

CVE-2014-0594

In the Open Build Service OBS before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent...

CVE-2014-0594

The CVE-2014-0594 entry corresponds to the Open Build Service (OBS) before version 2.4.6, where CSRF protection was incorrectly disabled in the web interface. This allows an attacker to issue requests without user consent, with impact across confidentiality, integrity, and availability as reflect...