CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS

More info at https://symfony.com/cve-2017-16653...

CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS

More info at https://symfony.com/cve-2017-16653...

CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS

More info at https://symfony.com/cve-2017-16653...

CVE-2017-7851

The CVE-2017-7851 vulnerability affects D-Link DCS-936L network cameras with firmware before 1.05.07. The issue is an inadequate CSRF protection mechanism that requires the device IP address to be a substring of the HTTP Referer header, enabling cross-site request forgery. Impact details in conne...

Cross-site Request Forgery (CSRF)

Hadoop YARN is vulnerable to cross-site request forgery CSRF attacks. The application does not have any CSRF protection, allowing an attacker to send requests to the Hadoop cluster...

GHSA-8FQX-7PV4-3JWM Improper Input Validation in actionpack

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...

Improper Input Validation in actionpack

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...

Improper Input Validation in rails

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...

Improper Input Validation

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...

CSRF Protection Bypass in Ruby on Rails

Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via forged 1 AJAX or 2 API requests that...

Cross-site Request Forgery (CSRF)

phpmyfaq is vulnerable to cross-site request forgery CSRF attacks. The application does not have CSRF protection for the phpmyfaq/admin/glossary.main.php file, allowing a malicious user to pass a request to the application to overwrite the current glossary...

Cross-Site Request Forgery (CSRF)

keycloak-services is vulnerable to cross-site request forgery CSRF attacks. The library does not include CSRF protection mechanisms, allowing attackers with valid session cookies to perform CSRF attacks...

Cross site request forgery (csrf)

A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking...

CVE-2017-12271

A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking...

RHEL 7 : rh-sso7-keycloak (RHSA-2017:2905)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2905 advisory. Red Hat Single Sign-On is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-o...

Cross site request forgery (csrf)

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery CSRF attacks by leveraging lack of CSRF protection...

Afian AB FileRun 2017.03.18 CSRF / Shell Upload / XSS / Redirection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017.09.18 impact: critical homepage: https://www.filerun.com |...

CVE-2017-12253

A vulnerability in the Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking the user of a web...

CVE-2017-12253

CVE-2017-12253 affects Cisco Unified Intelligence Center (CUIC). The issue is a cross-site request forgery (CSRF) vulnerability in the CUIC web UI due to missing CSRF protections. An unauthenticated, remote attacker could trick a logged-in user into performing unintended actions in CUIC by visiti...

CVE-2017-12253

A vulnerability in the Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking the user of a web...