halo-cve-2026-67919

URL을 통한 halo 플러그인 RCE halo 콘솔을 사용하면 관리자가 URL을 붙여넣어 플러그인을 설치하거나 업그레이드할 수 있습니다. 임의의 URL을 가져와 jar를 설치하며, jar의 코드가 서버에서 실행됩니다. 스킴 검사도, 호스트 검사도 없고 리디렉션을 따라가며, 플러그인 관리자는 jar에서 확장 클래스를 직접 로드합니다. 이것은 cve-2026-67919install-from-uri / upgrade-from-uri, cve-2026-67920migration restore, cve-2026-67921csrf/co...

CVE-2026-73292

CVE-2026-73292 – Semaphore UI 교육 및 책임 있는 공개 목적으로만 사용하세요. 이 취약점은 GHSA-8cj9-r88m-8945에 보고되었으며 semaphoreui 2.18.21 미만 버전에 영향을 미칩니다. 취약점 Semaphore UI의 비밀번호 변경 엔드포인트에는 CSRF 보호가 구현되어 있지 않습니다: CSRF 토큰이 필요하지 않음 현재 비밀번호 확인이 필요하지 않음 인증은 SameSite 적용 없이 세션 쿠키semaphore에만 의존합니다 악성 페이지는 방문한 인증된 사용자의 비밀번호를 사용자 모...

CVE-2025-28355

CVE-2025-28355 https://github.com/Volmarg/personal-management-system 애플리케이션은 CSRF 공격에 취약한 것으로 확인되었습니다. 공격자가 수행할 수 있는 많은 작업 중 하나는 합법적인 사용자를 속여 비밀번호를 변경하는 교차 사이트 요청을 실행하게 하여 공격자가 애플리케이션에 접근할 수 있도록 하는 것입니다. 이 취약점은 Firefox와 같이 "SameSite" 쿠키 속성 기본값이 none인 브라우저가 필요합니다. 벡터 문자열 :...

CVE-2026-86066 Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

EUVD-2026-87371

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-86066 Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-92751

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...

CVE-2026-81919 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint the arrange action of Concrete\Controller\Backend\Page\ArrangeBlocks. The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an...

CVE-2026-53660

OpenAM (Open Access Management) prior to 16.1.1 ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false and no protective SameSite attribute by default. The same cookie is reused as a CSRF token through CsrfProtection in OAuth and OpenID Connect consent flows. Combined with a same-origin XSS...

CVE-2026-53660 OpenAM Insecure SSO Cookie Initialization

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through...

CVE-2026-53660 OpenAM Insecure SSO Cookie Initialization

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through...

CVE-2026-53660 OpenAM Insecure SSO Cookie Initialization

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through...

PT-2026-92390

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint the arrange action of ConcreteControllerBackendPageArrangeBlocks. The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an attacker...

CVE-2026-53660: Sensitive Cookie Without 'HttpOnly' Flag

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through...

Astra Linux – Vulnerability in python-tornado

In Tornado before version 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments of .RequestHandler.setcookie were not checked for crafted characters...

Astra Linux – Vulnerability in Firefox

When opening a website using the firefox:// protocol handler, SameSite cookies were not properly respected. This vulnerability affects Firefox versions 123...

Astra Linux – Vulnerability in Firefox, Thunderbird

Requests initiated through the reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

Astra Linux – Vulnerability in Firefox and Thunderbird

When a ServiceWorker intercepted a request using FetchEvent, the origin of the request was lost after the ServiceWorker took control of it. This caused the SameSite cookie protections to be negated. This issue was addressed in the specifications, and later in various browsers. This vulnerability...

Komari: Management Interface CSRF

Vulnerability Overview The sessiontoken cookie is set without the SameSite or Secure attributes login.go:68. All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however,...

GHSA-HXJG-93WC-H8P8 Komari: Management Interface CSRF

Vulnerability Overview The sessiontoken cookie is set without the SameSite or Secure attributes login.go:68. All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however,...