CVE-2022-31277

Xiaomi Lamp 1 v2.0.40066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request...

Haraj 跨站脚本漏洞

A security vulnerability exists in Haraj v3.7, a buying and selling platform from Haraj Saudi Arabia, due to a cross-site scripting issue in the comments section of advertisements. An attacker could exploit the vulnerability to execute arbitrary Web script or HTML via a crafted POST request...

Haraj v3.7 跨站脚本漏洞

A cross-site scripting vulnerability exists in Haraj v3.7, a buying and selling platform from Haraj Saudi Arabia. The vulnerability stems from a lack of data validation filtering of user-supplied data and output in some DM components. An attacker could exploit this vulnerability to execute...

PT-2022-3474 · Schneider Electric · Conext Combox

Name of the Vulnerable Software and Affected Versions: Conext ComBox All Versions Description: A Cross-Site Request Forgery CSRF issue exists, potentially allowing an attacker to override system configurations and cause a reboot loop through a specially crafted POST request. This could lead to a...

PT-2022-21180 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.1 Description: A vulnerability has been identified that could expose sensitive user information. This occurs when a customized HTTP POST request forces the application to write the status of a...

Cross site request forgery (csrf)

The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form...

CVE-2022-0642

The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject...

CVE-2022-0642

The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject...

Regular Expression Denial Of Service (ReDoS)

rack is vulnerable to regular expression denial of service. The vulnerability exists because the BROKENQUOTED and BROKENUNQUOTED attributes in the Multipart module of multipart.rb does not properly restrict the broken mime parser, allowing an attacker to crash the application by providing malicio...

GHSA-HXQX-XWVH-44M2 Denial of Service Vulnerability in Rack Multipart Parsing

There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122. Versions Affected: = 1.2 Not affected: 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted multipart POST...

Denial of Service Vulnerability in Rack Multipart Parsing

There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122. Versions Affected: = 1.2 Not affected: 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted multipart POST...

CSRF vulnerability in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials

A cross-site request forgery CSRF vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins...

GHSA-MWG2-3XPV-5V28 CSRF vulnerability in Jenkins Micro Focus Application Automation Tools Plugin

Micro Focus Application Automation Tools Plugin 6.7 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to connect to attacker-specified URLs using attacker-specified username and password. Additionally, these...

CSRF vulnerability in Jenkins Micro Focus Application Automation Tools Plugin

Micro Focus Application Automation Tools Plugin 6.7 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to connect to attacker-specified URLs using attacker-specified username and password. Additionally, these...

GHSA-9F37-GGXM-H6WX CSRF vulnerability in Jenkins Shelve Project Plugin

Jenkins Shelve Project Plugin 3.0 and earlier does not require POST requests for HTTP endpoints, resulting in cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow attackers to shelve, unshelve, or delete a project. Jenkins Shelve Project Plugin 3.1 requires POST requests f...

GHSA-Q564-VVX8-9388 CSRF vulnerability in Jenkins warnings Plugin allows remote code execution

warnings Plugin 5.0.1 and earlier does not require POST requests for a form validation method intended for testing custom warnings parsers, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to execute arbitrary code. warnings Plugin 5.0.2 requires...

CSRF vulnerability in Jenkins Lockable Resources Plugin

Lockable Resources Plugin 2.8 and earlier does not require POST requests for several HTTP endpoints, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to reserve, unreserve, unlock, and reset resources. Lockable Resources Plugin 2.9 requires POST...

CSRF vulnerability in Jenkins Database Plugin

Database Plugin 1.6 and earlier does not require POST requests for the database console, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to execute arbitrary SQL scripts. Database Plugin 1.7 removes the database console...

GHSA-VJF8-XW6C-WJHQ CSRF vulnerability in Jenkins Flaky Test Handler Plugin

Flaky Test Handler Plugin 1.0.4 and earlier does not require POST requests for the "Deflake this build" feature, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to rebuild a project at a previous git revision where the tests were failing...

CSRF vulnerability in Jenkins Flaky Test Handler Plugin

Flaky Test Handler Plugin 1.0.4 and earlier does not require POST requests for the "Deflake this build" feature, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to rebuild a project at a previous git revision where the tests were failing...