CVE-2023-45670

CVE-2023-45670 : Frigate before 0.13.0 Beta 3 exposes a CSRF vulnerability in the config/save and config/set endpoints, allowing an attacker to trigger arbitrary configuration updates on a Frigate server via a crafted link. Exploitation requires the attacker to know specific server details and pe...

CVE-2023-45670 Frigate cross-site request forgery in `config_save` and `config_set` request handlers

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the config/save and config/set endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server e.g. via...

CVE-2023-45670 Frigate cross-site request forgery in `config_save` and `config_set` request handlers

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the config/save and config/set endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server e.g. via...

CVE-2023-45815 Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context in ArchiveBox

ArchiveBox is an open source self-hosted web archiving system. Any users who are using the wget extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to...

Go Fiber CSRF Token Validation Vulnerability

A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and...

PT-2023-29718 · WordPress · Mohsin Rafique Amp Wp – Google Amp For Wordpress

Name of the Vulnerable Software and Affected Versions: Mohsin Rafique AMP WP – Google AMP For WordPress plugin versions = 1.5.15 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web applicati...

PT-2023-29836 · WordPress · Mahlamusa Who Hit The Page – Hit Counter

Name of the Vulnerable Software and Affected Versions: Mahlamusa Who Hit The Page – Hit Counter plugin versions = 1.4.14.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application tha...

Cross site request forgery (csrf)

Request to LDAP is sent before user permissions are checked...

PT-2023-15218 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: P Royal Royal Elementor Addons and Templates plugin versions 1.3.75 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performin...

Progress WS_FTP Server < 8.8.2 Multiple Vulnerabilities

The remote host is running a version of WSFTP earlier than to 8.8.2. Such versions are reportedly affected by multiple vulnerabilities : - A stored cross-site scripting XSS vulnerability exists in WSFTP Server's Management module. An attacker with administrative privileges could import a SSL...

PT-2023-26235 · Unknown · Mike Perelink Pro

Name of the Vulnerable Software and Affected Versions: Mike Perelink Pro plugin versions = 2.1.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticate...

CVE-2023-40048

CVE-2023-40048 affects Progress WS_FTP Server (Manager interface). The vulnerability is a CSRF flaw on a POST transaction used for an administrative function, present in versions prior to 8.8.2. Technical details in connected docs confirm the affected component and root cause (missing CSRF protec...

Progress Software WS_FTP Server Cross-Site Request Forgery Vulnerability

Progress Software WSFTP Server is an effective and highly manageable FTP server from Progress Software, Inc. A cross-site request forgery vulnerability exists in Progress Software WSFTP Server versions prior to 8.8.2, which stems from a lack of cross-site request forgery CSRF protection...

CVE-2023-2508

The PaperCutNG Mobility Print version 1.0.3512 application allows an unauthenticated attacker to perform a CSRF attack on an instance administrator to configure the clients host in the "configure printer discovery" section. This is possible because the application has no protections against CSRF...

GHSA-HJ7P-H74J-6GXJ Non-constant time nonce comparison in Jenkins Microsoft Entra ID (previously Azure AD) Plugin

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

Non-constant time nonce comparison in Jenkins Microsoft Entra ID (previously Azure AD) Plugin

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

CVE-2023-41935

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

CVE-2015-1391

Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism...

CVE-2015-1391

Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism...

CVE-2023-3366

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.2 does not have CRSF check when deleting a shipment, allowing attackers to make any logged in user, delete arbitrary shipment via a CSRF attack...