10425 matches found
CVE-2020-35942
A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. It is possible to bypass CSRF protection by simply not including a nonce parameter...
CVE-2021-20652
CVE-2021-20652 is the WordPress Name Directory plugin CSRF vulnerability affecting versions 1.17.4 and earlier. A remote attacker could hijack an administrator’s session via cross-site requests; vectors are not specified in the provided documents. Remediation per connected sources is to update th...
PT-2021-12848 · Squaredup · Squaredup
Name of the Vulnerable Software and Affected Versions: SquaredUp versions prior to 4.6.0 Description: The issue allows for a potential CSRF attack, where an administrator could execute arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a...
CVE-2020-24271
A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/closeCurrent, then post username=&password=...
LOGITEC CORPORATION LAN-WN/PRB Cross-Site Request Forgery Vulnerability
A cross-site request forgery vulnerability exists in LOGITEC CORPORATION LAN-W300N / PR5B. When a user logged in to the device management web page accesses a specially crafted URL, an unintended action on the device such as - may change device settings...
CVE-2021-21275
The MediaWiki "Report" extension has a Cross-Site Request Forgery CSRF vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of MediaWiki edit...
CVE-2020-23342
A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users...
Cross-site Request Forgery (CSRF)
Overview fastify-csrf is an A plugin for adding CSRF protection to Fastify. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true . Also, the CS...
Joomla! 1.7.x < 3.9.23 Multiple Vulnerabilities
According to its self-reported version, the instance of Joomla! running on the remote web server is 1.7.x prior to 3.9.23. It is, therefore, affected by multiple vulnerabilities. - The autosuggestion feature of comfinder did not respect the access level of the corresponding terms. - The globlal...
UBUNTU-CVE-2020-36191
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an xsrf field, as demonstrated by a /hub/api/user request to add or remove a user account...
CVE-2020-35687
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim. Recent assessments: oosman-rak at January 20, 2021 4:08am UTC reported: Assessed Attacker Value: 3 Assessed Attacker Value: 3Assessed Attacker...
CVE-2021-21495
MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executarcentral.php?acao=altsenhaprinc URI...
Cross site request forgery (csrf)
The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy...
CVE-2018-16795
OpenEMR 5.0.1.3 allows Cross-Site Request Forgery CSRF via library/ajax and interface/super, as demonstrated by use of interface/super/managesitefiles.php to upload a .php file...
CVE-2020-35773
The site-offline plugin before 1.4.4 for WordPress lacks certain wpcreatenonce and wpverifynonce calls, aka CSRF...
Site Offline < 1.4.4 - Multiple Cross-Site Request Forgery
The lack of CSRF checks could allow attackers to make a logged administrator change some of the plugin's settings...
CVE-2020-35615
An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of comprivacy causes a CSRF vulnerability...
Cross site request forgery (csrf)
An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of comprivacy causes a CSRF vulnerability...