1717 matches found
GHSA-58C5-G7WP-6W37 Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery XSRF token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol...
CVE-2025-13283
TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could...
CVE-2025-13282
TenderDocTransfer (Chunghwa Telecom) exposes a combination of flaws: (1) an Absolute Path Traversal within one API that could allow deletion of arbitrary files on the user’s system, and (2) APIs with no CSRF protection, enabling unauthenticated remote attackers to trigger actions via phishing. Th...
PT-2025-47111
Name of the Vulnerable Software and Affected Versions Chunghwa Telecom TenderDocTransfer affected versions not specified Description The application establishes a local web server and offers APIs for communication. A lack of CSRF protection in the APIs allows unauthenticated remote attackers to...
PT-2025-44318
Name of the Vulnerable Software and Affected Versions BLU-IC2 versions through 1.19.5 BLU-IC4 versions through 1.19.5 Description A systemic lack of Cross-Site Request Forgery CSRF token implementation exists. This complete absence of CSRF protections in BLU-IC controllers allows for trivial...
EUVD-2025-36108
The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users...
CVE-2025-11154
The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users...
CVE-2025-11154
CVE-2025-11154 affects IDonate for WordPress, vulnerable in versions prior to 2.1.13 due to missing authorization and CSRF protection when deleting users via an action handler. This unauthenticated flow allows an attacker to delete arbitrary users. Reported across multiple sources (Wordfence, Pat...
CVE-2025-11154 IDonate < 2.1.13 - Unauthenticated User Deletion
The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users...
EUVD-2019-5962
Malware in sbrugna...
EUVD-2020-27082
Malware in sbrugna...
EUVD-2020-11782
Malware in sbrugna...
EUVD-2011-4852
Malware in sbrugna...
EUVD-2021-14647
Malware in sbrugna...
EUVD-2008-4907
Malware in sbrugna...
EUVD-2019-5696
Malware in sbrugna...
EUVD-2019-5216
Malware in sbrugna...
EUVD-2018-0969
Malware in sbrugna...