PT-2023-21658 · Moodle +6 · Moodle +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue is related to a link used to reset all templates of a database activity, which did not include the necessary token to prevent a CSRF risk. This could potentially allow...

imcat 跨站请求伪造漏洞

Imcat is a PHP-based open source website building system. A security vulnerability exists in version 5.4 of imcat, which stems from the presence of cross-site request forgery, which can be exploited by a remote attacker to elevate privileges through the lack of token authentication...

Joomla! 跨站请求伪造漏洞

Joomla! is a set of forum components used in the Joomla! content management system. A security vulnerability exists in Joomla! versions 4.0.0 through 4.2.6, which stems from a missing token check. An attacker can exploit this vulnerability to perform cross-site request forgery attacks...

PT-2023-32995 · Unknown · Csrfcomponent

Name of the Vulnerable Software and Affected Versions: CsrfComponent affected versions not specified Description: The issue is related to the CsrfComponent, which fails to invalidate requests that are missing both the CSRF token and CSRF post data. Recommendations: At the moment, there is no...

Webmin 跨站请求伪造漏洞

Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community.Webmin version 1.973 is vulnerable to cross-site request forgery, which stems from the lack of token validation for cross-site request forgery in the scheduled Cron job function. An...

Webmin 跨站请求伪造漏洞

Webmin is the Webmin community's set of Web-based system administration tools for Unix-like operating systems. A cross-site request forgery vulnerability exists in Webmin version 1.973, which stems from a lack of token validation for cross-site request forgery in the upload and download functions...

IBM Sterling B2B Integrator 跨站请求伪造漏洞

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates important B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with different partner communities.BM Sterling B2B Integrator is vulnerable to a cross-site...

IceHrm 跨站请求伪造漏洞

IceHrm is a human resource management Hrm system. The system includes features such as employee management, leave management and payroll management. A security vulnerability exists in IceHrm version 31.0.0.0S, which stems from the lack of token validation in the software for cross-site request...

qdPM 跨站请求伪造漏洞

qdPM is a Web-based open source project management tool. A cross-site request forgery vulnerability exists in qdPM version 9.2. The vulnerability stems from the lack of token validation in the software for cross-site request forgery, resulting in a cross-site request forgery vulnerability...

Jenkins Plugin 跨站请求伪造漏洞

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . A cross-site request forgery vulnerability exists in Jenkins Mailer that stems from the software's lack of validation f...

Adobe Connect 跨站请求伪造漏洞

Adobe Connect is a software used to create meeting environments by Adobe. Adobe Connect suffers from a cross-site request forgery vulnerability that stems from the software's lack of token authentication for cross-site request forgery, which can be exploited by an attacker to trigger an arbitrary...

CVE-2021-43559

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk...

Cross-Site Request Forgery (CSRF) in myvesta/vesta

✍️ Description The download/web-log endpoint does not have CSRF Protection. This could be used to force download access log and potentially sensitive information leakage. 🕵️‍♂️ Proof of Concept Login to user account. Create the following POC.html file and open the page in browser. To verify that...

Machform 跨站请求伪造漏洞

MachForm is an HTML form builder that lets you create contact forms, surveys, order forms or any other web form without writing code. A cross-site request forgery CSRF vulnerability exists in versions prior to Machform 16. The vulnerability stems from a missing CSRF token. An attacker can exploit...

Joomla! cross-site request forgery vulnerability (CNVD-2021-38296)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site request forgery vulnerability exists in combanners and comsysinfo in...

Joomla! cross-site request forgery vulnerability (CNVD-2021-38295)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site request forgery vulnerability exists in the AJAX reordering endpoint...

Cross site request forgery (csrf)

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint...

PT-2021-16926 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.26 Description: A missing token check causes a CSRF issue in the "AJAX reordering endpoint". Recommendations: For Joomla! versions 3.0.0 through 3.9.26, update to a version that includes the fix for the...

Joomla! 3.x < 3.9.27 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.9.27. It is, therefore, affected by multiple vulnerabilities. - HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors. CVE-2021-26032...

Joomla! 跨站请求伪造漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site request forgery vulnerability exists in the AJAX reordering endpoint...