Cross-site Request Forgery (CSRF)

@fastify/csrf-protection is vulnerable to Cross-site Request Forgery CSRF. An attackers is able to bypass the CSRF protection mechanism by fixing a csrf cookie in the victim's browser and forging valid CSRF tokens that are valid for the victim's session...

CVE-2023-31061

Repetier Server through 1.4.10 does not have CSRF protection...

PT-2023-16967 · WordPress · Wp Vr

Name of the Vulnerable Software and Affected Versions: WP VR WordPress plugin versions prior to 8.3.0 Description: The issue concerns a lack of authorization and CSRF checks in various AJAX actions within the WP VR WordPress plugin. This could allow any authenticated user, such as a subscriber, t...

Side Cart Woocommerce < 2.2 - Settings Reset via CSRF

The plugin does not have CSRF check when reseting its Settings, which could allow attackers to make logged in admins perform such action via a CSRF attack PoC Make a logged in admin open https://example.com/wp-admin/admin.php?page=side-cart-woocommerce-settings=yes...

PT-2023-23127 · Unknown · Repetier Server

Name of the Vulnerable Software and Affected Versions: Repetier Server versions through 1.4.10 Description: The issue is related to the lack of CSRF protection. This means that the software does not have measures in place to prevent cross-site request forgery attacks, which could allow an attacke...

CVE-2023-31061

Repetier Server through 1.4.10 does not have CSRF protection...

CVE-2023-29020

@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF Cross-Site Request Forger protection enforced by the @fastify/csrf-protection library, when combined with @fastify/passport in affected versions, can be bypassed by network and same-site attackers...

Cross site request forgery (csrf)

@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF Cross-Site Request Forger protection enforced by the @fastify/csrf-protection library, when combined with @fastify/passport in affected versions, can be bypassed by network and same-site attackers...

CVE-2023-29020 Cross site request forgery token fixation in fastify-passport

@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF Cross-Site Request Forger protection enforced by the @fastify/csrf-protection library, when combined with @fastify/passport in affected versions, can be bypassed by network and same-site attackers...

CVE-2023-29020 Cross site request forgery token fixation in fastify-passport

@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF Cross-Site Request Forger protection enforced by the @fastify/csrf-protection library, when combined with @fastify/passport in affected versions, can be bypassed by network and same-site attackers...

PT-2023-22093 · Unknown · @Fastify/Csrf-Protection +1

Name of the Vulnerable Software and Affected Versions: @fastify/passport versions prior to the version that includes the configuration options clearSessionOnLogin and clearSessionIgnoreFields Description: The CSRF protection enforced by the @fastify/csrf-protection library, when combined with...

@flowforge/flowforge (>=0.9.0, <=0.10.0), schwing (>=0.2.14, <=0.2.26) potentially affected by CVE-2023-27495 via @fastify/csrf-protection (5.1.0)

@fastify/csrf-protection NPM version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/csrf-protection and may be impacted: - @flowforge/flowforge =0.9.0, =0.2.14, =0.2.26 Source cves: CVE-2023-27495 Source advisory: OSV:GHSA-QRGF-9GPC-VRX...

CVE-2023-27495

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

Cross site request forgery (csrf)

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

CVE-2023-27495 Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

CVE-2023-27495

The CVE-2023-27495 entry concerns the @fastify/csrf-protection plugin for Fastify. A CSRF protection bypass can occur when the optional userInfo parameter is missing or its value is predictable, allowing network and same-site attackers to fixate the _csrf cookie and forge valid tokens for a user’...

CVE-2023-27495 Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection

@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions...

RapidExpCart <= 1.0 - Stored XSS via CSRF

The plugin does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the page, leading to a Stored Cross-Site Scripting vulnerability which could be used against high-privilege users such as admin, furthermore lack of csrf protection...

Clock In Portal <= 2.1 - Staff Deletion via CSRF

The plugin does not have CSRF check when deleting Staff members, which could allow attackers to make logged in admins delete arbitrary Staff via a CSRF attack PoC Make a logged in admin open a page with the code below, this will make them delete the Staff with ID 1...

WordPress Plugin Themeflection Numbers 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...