CVE-2024-4403

A Cross-Site Request Forgery CSRF vulnerability exists in the restartprogram function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF...

CVE-2024-4403

A Cross-Site Request Forgery CSRF vulnerability exists in the restartprogram function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF...

CVE-2024-4403

CVE-2024-4403 affects the ParisNeo/LollMS-WebUI, v9.6. The issue is a CSRF vulnerability in the restart_program function , which can be triggered to cause unintended actions (e.g., resetting the program) by sending crafted CSRF forms. The flaw is attributed to a lack of CSRF protection in the aff...

CVE-2024-4403 CSRF in restart_program in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the restartprogram function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF...

CVE-2024-4328

A Cross-Site Request Forgery CSRF vulnerability exists in the clearpersonalityfileslist function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users...

CVE-2024-4328

A Cross-Site Request Forgery CSRF vulnerability exists in the clearpersonalityfileslist function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users...

CVE-2024-4328

The CVE-2024-4328 issue is a CSRF vulnerability in the parisneo/lollms-webui v9.6, caused by using a GET request in clear_personality_files_list that lacks CSRF protection. This allows an attacker to coerce authenticated users into performing actions (e.g., deleting files) without consent. Affect...

CVE-2024-4328 CSRF in clear_personality_files_list in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the clearpersonalityfileslist function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users...

CVE-2024-4328 CSRF in clear_personality_files_list in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the clearpersonalityfileslist function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users...

RHEL 6 : mailman (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mailman: Missing CSRF protection in admin web interface CVE-2016-7123 - Cross-site request forgery CSRF...

RHEL 5 : mailman (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mailman: directory traversal in MTA transports that deliver programmatically CVE-2015-2775 - mailman:...

Code Injection

symfony is vulnerable to Code Injection. The vulnerability is due to lack of CSRF protection for the import/export feature, allowing attackers to exploit the PHP serialized string import...

PT-2024-40210 · Sylius · Sylius

Name of the Vulnerable Software and Affected Versions: Sylius versions 1.0.0 through 1.0.16 Sylius versions 1.1.0 through 1.1.8 Sylius versions 1.2.0 through 1.2.1 Description: The issue affects certain actions in the admin panel that did not require a CSRF token, including marking order's paymen...

PT-2024-40501 · Packagist · Silverstripe/Graphql

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned Description: The issue concerns a lack of CSRF protection in the GraphQL controller. This means that authenticated users could be forced or tricked into visiting a URL that sends a GET request to the...

Cross-Site Request Forgery (CSRF)

ezsystems/ezplatform is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the CSRF protection which is not enabled by default., which allows attackers to perform unauthorized actions by exploiting the inactive CSRF token...

GHSA-VJ2J-6G3W-4662 Silverstripe Missing CSRF protection in login form

LoginForm calls disableSecurityToken, which causes a "shared host domain" vulnerability: http://stackoverflow.com/a/15350123...

Silverstripe Missing CSRF protection in login form

LoginForm calls disableSecurityToken, which causes a "shared host domain" vulnerability: http://stackoverflow.com/a/15350123...

Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter

GridField does not have sufficient CSRF protection, meaning that in some cases users with CMS access can be tricked into posting unspecified data into the CMS from external websites. Amongst other default CMS interfaces, GridField is used for management of groups, users and permissions in the CMS...

PT-2024-40027 · Silverstripe · Silverstripe Cms

Name of the Vulnerable Software and Affected Versions: Silverstripe CMS affected versions not specified Description: The issue concerns insufficient CSRF protection in GridField, which can be exploited to trick users with CMS access into posting unspecified data from external websites. This affec...

CVE-2024-3631

The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admins perform such actions via a CSRF attack...