Cross site request forgery (csrf)

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...

CVE-2018-19544

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...

CVE-2018-19545

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

CVE-2018-19544

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...

Cross site request forgery (csrf)

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

CVE-2018-19545

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

CVE-2018-19545

JEECMS 9.3 contains a CSRF vulnerability in the admin endpoint api/admin/role/save that can be abused to add a new user. Root cause is CSRF on the user-creation pathway; impact is user creation with high severity (CVSS3 base score 8.8) as cited in the CVE record. Exploitation details or fix are n...

CVE-2018-19544

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...

CVE-2018-19544

JEECMS 9.3 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that can be triggered via the api/admin/content/save URI to add news. The issue is documented across multiple sources (NVD/NVD mirror and CVE listings). The vulnerability details are focused on CSRF in JEECMS 9.3; no expl...

CVE-2018-19545

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

PT-2018-14990

Name of the Vulnerable Software and Affected Versions JEECMS version 9.3 Description The issue allows for CSRF via the "api/admin/role/save" API endpoint to add a user. Recommendations For JEECMS version 9.3, consider implementing proper CSRF protection mechanisms to prevent unauthorized actions...

JEECMS Cross-Site Request Forgery Vulnerability

JEECMS is a set of China Jinlei Technology Development Corporation using Java language development of content management systems CMS. A cross-site request forgery vulnerability exists in JEECMS version 9.3. A remote attacker can use api/admin/role/save URI to add users...

PT-2018-14989

Name of the Vulnerable Software and Affected Versions JEECMS version 9.3 Description The issue allows for CSRF via the "api/admin/content/save" API endpoint to add news. Recommendations For JEECMS version 9.3, as a temporary workaround, consider restricting access to the "api/admin/content/save"...

CVE-2018-19544: Cross-Site Request Forgery (CSRF)

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...

CVE-2018-19545: Cross-Site Request Forgery (CSRF)

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

CVE-2018-18952

JEECMS 9.3 has XSS via an index.do/content/update?type=update URI...

Design/Logic Flaw

JEECMS 9.3 has XSS via an index.do/content/update?type=update URI...

CVE-2018-18952

JEECMS 9.3 has XSS via an index.do/content/update?type=update URI...

CVE-2018-18952

JEECMS 9.3 has XSS via an index.do/content/update?type=update URI...

CVE-2018-18952

The connected sources confirm CVE-2018-18952 affects JEECMS 9.3 with a cross-site scripting (XSS) vulnerability exploitable via the index.do#/content/update?type=update URI. The underlying issue is an XSS flaw in that endpoint, enabling injected script in user-controlled content. The available do...