PT-2018-12489

Name of the Vulnerable Software and Affected Versions Creme CRM version 1.6.12 Description An issue was discovered where the value of the cancel button uses the content of the HTTP Referer header. This could be used to trick a user into visiting a fake login page in order to steal credentials...

Cross site scripting

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

CVE-2018-9186

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

CVE-2018-9186

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

CVE-2018-9186

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

CVE-2018-9186

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

PT-2018-18910

Name of the Vulnerable Software and Affected Versions Fortinet FortiAuthenticator versions 4.0.0 through 5.3.0 Description A cross-site scripting XSS issue exists due to a CSRF validation failure, allowing an attacker to execute unauthorized script code by injecting malicious scripts in the HTTP...

CVE-2018-9186: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

Cross site request forgery (csrf)

D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...

CVE-2017-7851

D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...

CVE-2017-7851: Cross-Site Request Forgery (CSRF)

D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...

CVE-2015-7391

Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the 1 selectedenddate or 2 selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the 3 containerType parameter to...

PT-2017-6352

Name of the Vulnerable Software and Affected Versions vBulletin VBSEO module affected versions not specified Description The issue allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php. This is due to a problem in the functions vbseo hook.ph...

CVE-2014-9463: Improper Control of Generation of Code

functionsvbseohook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HTTP Referer header is not checked...

CVE-2017-12651

Cross Site Request Forgery CSRF exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HTTP Referer header is not checked...

CVE-2017-12651

CVE-2017-12651 affects the WordPress Loginizer plugin (versions prior to 1.3.6). The vulnerability is a Cross-Site Request Forgery (CSRF) in the Blacklist and Whitelist IP Wizard (init.php) due to the HTTP Referer header not being checked. This can allow an attacker to manipulate IP blacklist/whi...

PT-2017-12630

Name of the Vulnerable Software and Affected Versions Loginizer plugin versions prior to 1.3.6 Description A Cross Site Request Forgery CSRF issue exists due to the lack of HTTP Referer header check in the Blacklist and Whitelist IP Wizard in init.php. Recommendations For versions prior to 1.3.6,...

CVE-2017-12651: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HTTP Referer header is not checked...

CVE-2017-12066

Cross-site scripting XSS vulnerability in aggregategraphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancelurl variable. NOTE: this vulnerability exists because of an incomplete fi...