GHSA-GJP8-99FV-CGCW Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This...

CVE-2025-47410

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the Management and Monitoring REST API when processing GET requests. An attacker can execute arbitrary commands on the target system by tricking an authenticated user into submitting malicious request...

CVE-2025-47410 Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This...

CVE-2025-47410 Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This...

EUVD-2025-34985

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'themeeditortheme' page. This makes it possible for unauthenticated attackers to achieve remote code execution v...

CVE-2025-9890

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'themeeditortheme' page. This makes it possible for unauthenticated attackers to achieve remote code execution v...

CVE-2025-9890 Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'themeeditortheme' page. This makes it possible for unauthenticated attackers to achieve remote code execution v...

CVE-2025-9890

The CVE-2025-9890 entry concerns the WordPress Theme Editor plugin (affected: WordPress Theme Editor) with a Cross-Site Request Forgery (CSRF) to Remote Code Execution vulnerability affecting all versions up to 3.0. The issue arises from missing/incorrect nonce validation on the theme_editor_them...

WordPress plugin Theme Editor 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

[SECURITY] [DSA 6028-1] lxd security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6028-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 17, 2025 https://www.debian.org/security/faq -...

[BSA-125] Security Update for incus

Mathias Gibbens uploaded new packages for incus which fixed the following security problems: CVE ID : CVE-2025-54286 CVE-2025-54287 CVE-2025-54288 CVE-2025-54289 CVE-2025-54290 CVE-2025-54291 CVE-2025-54293 Multiple security issues were discovered in Incus, a system container and virtual machine...

[SECURITY] [DSA 6027-1] incus security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6027-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 17, 2025 https://www.debian.org/security/faq -...

Vulnerabilities fixed in SAP Products

SAP has fixed vulnerabilities in several SAP products. The vulnerabilities include a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary OS commands, and a CSRF vulnerability that allows authenticated attackers to bypass critical authorization controls. In...

CVE-2025-10700

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enableunfilteredfilesupload function. This makes it possible for unauthenticated...

Rockwell Automation Comms-1783-NATR Cross-Site Request Forgery Vulnerability

Rockwell Automation Comms-1783-NATR is an industrial Ethernet address translation device from Rockwell Automation. The Rockwell Automation Comms-1783-NATR suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to cause a specially crafted link to trick a...

SAP NetWeaver AS ABAP Multiple Vulnerabilities (October 2025)

The version of SAP NetWeaver Application Server for ABAP detected on the remote host is affected by multiple vulnerabilities as disclosed in the SAP Security Patch Day October 2025: - Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacke...

CVE-2025-41254

CVE-2025-41254 affects Spring Framework STOMP over WebSocket. The vulnerability allows a security bypass to send unauthorized messages. Affected versions are Spring Framework 6.2.0–6.2.11, 6.1.0–6.1.23, 6.0.x–6.0.29, and 5.3.0–5.3.45; older unsupported versions are also affected. Remediation requ...

WordPress Product Catalog Simple plugin <= 1.8.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Product Catalog Simple versions = 1.8.4...

CVE-2025-10300

The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the fmenbtopbarsavesettings function. This makes it possible for unauthenticated attackers to update the plugin's settin...