PT-2022-16190 · Aruba · Arubaos-Cx Switches

Name of the Vulnerable Software and Affected Versions: ArubaOS-CX Switches versions 10.06.0200 and below ArubaOS-CX Switches versions 10.08.1060 and below ArubaOS-CX Switches versions 10.09.1020 and below ArubaOS-CX Switches versions 10.10.0002 and below Description: The issue is related to the...

Cross site request forgery (csrf)

The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors reporter by the submitter or update arbitrary order status...

CVE-2022-2657 Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls

The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors reporter by the submitter or update arbitrary order status...

PT-2022-17935 · WordPress · Multivendor Marketplace Solution For Woocommerce

Name of the Vulnerable Software and Affected Versions: Multivendor Marketplace Solution for WooCommerce WordPress plugin versions prior to 3.8.12 Description: The issue is related to a lack of authorization and CSRF protection in multiple AJAX actions. This could allow authenticated users, such a...

PT-2022-15655 · WordPress · Wp Edit Menu

Name of the Vulnerable Software and Affected Versions: WP Edit Menu WordPress plugin versions prior to 1.5.0 Description: The issue concerns a lack of CSRF protection in an AJAX action, which could allow attackers to make a logged-in admin delete arbitrary posts or pages from the blog via a CSRF...

CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection

Impact This vulnerability may allow SameSite Attackers to bypass the CodeIgniter4 CSRF protection mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct or indirect, e.g., XSS control over a subdomain site e.g., https://a.example.com/ of the target site e.g.,...

GHSA-5HM8-VH6R-2CJQ CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection

Impact This vulnerability may allow SameSite Attackers to bypass the CodeIgniter4 CSRF protection mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct or indirect, e.g., XSS control over a subdomain site e.g., https://a.example.com/ of the target site e.g.,...

CVE-2022-36312

Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models...

PT-2022-23308 · Airspan · Airspan Airvelocity 1500

Name of the Vulnerable Software and Affected Versions: Airspan AirVelocity 1500 version 15.18.00.2511 Description: The issue is related to a lack of CSRF protections in the eNodeB's web management UI. This may potentially affect other AirVelocity and AirSpeed models. Recommendations: For Airspan...

Cross-Site Request Forgery (CSRF)

codeigniter4/shield is vulnerable to cross-site request forgery. The vulnerability exists in the startLogin function of Session.php, allowing same site attackers to bypass the CSRF Protection mechanism and redirect to malicious urls such as https://a.example.com/ and http://example.com/ when the...

CVE-2022-35943 SameSite may allow cross-site request forgery (CSRF) protection to be bypassed

Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow SameSite Attackers to bypass the CodeIgniter4 CSRF protection mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct or indirect, e.g., XSS control over a...

CVE-2022-35943 SameSite may allow cross-site request forgery (CSRF) protection to be bypassed

Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow SameSite Attackers to bypass the CodeIgniter4 CSRF protection mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct or indirect, e.g., XSS control over a...

CVE-2022-35943 SameSite may allow cross-site request forgery (CSRF) protection to be bypassed

Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow SameSite Attackers to bypass the CodeIgniter4 CSRF protection mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct or indirect, e.g., XSS control over a...

CVE-2022-2241

The Featured Image from URL FIFU WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of validation, sanitisation and escaping in some of them, ...

CVE-2022-2260

The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the...

Cross site request forgery (csrf)

The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the...

PT-2022-15412 · WordPress · Featured Image From Url

Name of the Vulnerable Software and Affected Versions: Featured Image from URL FIFU WordPress plugin versions prior to 4.0.1 Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

Transposh WordPress Translation 1.0.8.1 Cross Site Request Forgery

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/ Type: Cross-Site Request Forgery CWE-253 Date found: 2021-08-19 Date...

CVE-2022-2071

The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them...

Stripe: CSRF in Importing CSV files [app.taxjar.com]

A CSRF vulnerability was found in the CSV import feature of app.taxjar.com, allowing an attacker to import transactions into a user's account without their permission. The vulnerability was due to a lack of CSRF protection in the import process...