PT-2020-15561

Name of the Vulnerable Software and Affected Versions Spiceworks versions prior to 7.5.00108 Description The issue allows for privilege escalation via the "/settings/v1/users" API endpoint. This can be exploited due to a CSRF flaw. Recommendations For versions prior to 7.5.00108, update to versio...

CVE-2020-14432

Certain NETGEAR devices are affected by CSRF. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 befor...

Warning: Researcher Drops phpMyAdmin Zero-Day Affecting All Versions

A cybersecurity researcher recently published details and proof-of-concept for an unpatched zero-day vulnerability in phpMyAdmin—one of the most popular applications for managing the MySQL and MariaDB databases. phpMyAdmin is a free and open source administration tool for MySQL and MariaDB that's...

CVE-2016-10962

The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php optionname parameter...

PT-2019-7267 · WordPress · Wp-Google-Map-Plugin

Name of the Vulnerable Software and Affected Versions: wp-google-map-plugin versions prior to 2.3.10 Description: The issue concerns a CSRF flaw in the add/edit map feature of the wp-google-map-plugin. No information is provided about the estimated number of potentially affected devices or...

PT-2019-7266 · WordPress · Wp-Google-Map-Plugin

Name of the Vulnerable Software and Affected Versions: wp-google-map-plugin versions prior to 2.3.10 Description: The issue concerns a CSRF flaw in the add/edit location feature of the wp-google-map-plugin. No information is provided about the estimated number of potentially affected devices or...

PT-2019-11765 · Jenkins · Jenkins Jclouds Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JClouds Plugin versions 2.14 and earlier Description: A missing permission check in the Jenkins JClouds Plugin allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs,...

U.S. Dept Of Defense: Self XSS combine CSRF at https://████████/index.php

Hi Team, I found that https://█████████/index.php has vulnerability by XSS in arg2 parameter. Anyway there is no csrf token tied with the post request. As a result this csrf flaw can make the self-xss as a global reflected xss. CSRF to XSS PoC history.pushState'', '', '/' You just need to copy an...

Fedora 26 : phpMyAdmin (2017-481515e199)

Upstream announcement : Welcome to phpMyAdmin 4.7.7, a regular maintenance release containing bug fixes and a security fix. The security vulnerability is a XSRF/CSRF flaw; you can read more at https://www.phpmyadmin.net/security/PMASA-2017-9/ As a result of this, we recommend all users upgrade...

CVE-2016-4854

Cross-site request forgery CSRF vulnerability in L-04D firmware version V10a and V10b allows remote attackers to hijack the authentication of administrators to perform arbitrary operations via unspecified vectors...

Subrion CMS Cross-Site Request Forgery Vulnerability (CNVD-2017-04652)

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A cross-site request forgery vulnerability exists in the admin/blog/add/ URI in Subrion CMS version 4.0.5...

UBUNTU-CVE-2016-6897

Cross-site request forgery CSRF vulnerability in the wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the checkajaxreferer...

Moderate: Red Hat Security Advisory: tomcat security, bug fix, and enhancement update

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Moderate: Red Hat Security Advisory: pcs security, bug fix, and enhancement update

An update for pcs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

Moderate: Red Hat Security Advisory: python-django security update

An update for python-django is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 Icehouse for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Apache Jackrabbit Cross-Site Request Forgery Vulnerability

Apache Jackrabbit is the United States Apache Apache Software Foundation, a full compliance with the Java API version of the content storage specification JCR implementation. A cross-site request forgery vulnerability exists in Apache Jackrabbit that stems from the program failing to properly...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update

Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update

Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 security update

Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6 and 7, Solaris, and Microsoft Windows from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives...

The Tale of One Thousand and One DSL Modems

This is the description of an attack happening in Brazil since 2011 using 1 firmware vulnerability, 2 malicious scripts and 40 malicious DNS servers, which affected 6 hardware manufacturers, resulting in millions of Brazilian internet users falling victim to a sustained and silent mass attack on...