10431 matches found
Cross site request forgery (csrf)
A vulnerability in the web-based management interface of Cisco Tetration Analytics could allow an authenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for t...
CVE-2018-0446
Cisco Industrial Network Director's web-based management interface is affected by a Cross-Site Request Forgery (CSRF) vulnerability due to insufficient protections. An unauthenticated remote attacker could coax a logged-in user to visit a malicious link, enabling arbitrary actions on the device w...
CVE-2018-17986
rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...
CVE-2018-15702
The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field...
CVE-2018-15702
The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field...
CVE-2018-17826
HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then use that account to execute arbitrary PHP code by leveraging app/common/model/AdminAnnex.php to add .php to the default list of allowable file-upload types .jpg, .png, .gif, .jpe...
GitLab: [Admin Panel] CSRF to resume/pause runner
Hi, Just found a CSRF in admin panel of gitlab instance to pause/resume runner. Steps to reproduce - http://gitlabinstance/admin/runners/:runnerid/resume - http://gitlabinstance/admin/runners/:runnerid/pause Video: ███████ password: ██████████ Impact Just found a CSRF in admin panel of gitlab...
CVE-2017-15608
Inedo ProGet before 5.0 Beta5 has CSRF, allowing an attacker to change advanced settings...
CVE-2018-17081
e107 2.1.9 allows CSRF via e107admin/wmessage.php?mode=&action=inline&ajaxused=1&id= for changing the title of an arbitrary page...
Server-side request forgery vulnerability in Mesos Plugin
A missing permission check in a form validation method in Mesos Plugin allowed users with Overall/Read permission to initiate a connection test, connecting to an attacker-specified URL. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. Thi...
Cross site request forgery (csrf)
An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do...
CVE-2018-6504
A potential Cross-Site Request Forgery CSRF vulnerability has been identified in ArcSight Management Center ArcMC in all versions prior to 2.81. This vulnerability could be exploited to allow for Cross-Site Request Forgery CSRF...
UNL-CMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19097)
UNL-CMS is a PHP-based content management system. A cross-site request forgery vulnerability exists in UNL-CMS version 7.59, which can be exploited by remote attackers to update the settings of a website with the help of the...
The administrative smart-commits resource was vulnerable to Cross-site request forgery (CSRF) - CVE-2018-13398
The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery CSRF vulnerability...
The administrative smart-commits resource was vulnerable to Cross-site request forgery (CSRF) - CVE-2018-13398
The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery CSRF vulnerability...
CVE-2018-17103
An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter...
CVE-2018-17103
An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter...
U.S. Dept Of Defense: Account takeover due to CSRF in "Account details" option on █████████
Summary: Hi DoD team, similarly to the previous CSRF that I've reported, I've found another CSRF in the same domain, but on the Account details option. Description: The CSRF issue allows me to modify the datas of every victim that is targeted using the CSRF file, and leading to account takeover...
Design/Logic Flaw
An issue was discovered in CMS MaeloStore V.1.5.0. There is a CSRF vulnerability that can change the administrator password via admin/modul/users/aksiusers.php?act=update...