WordPress plugin User Session Synchronizer 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

CVE-2024-25002

Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device...

CVE-2024-25002

Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device...

CVE-2024-25002

CVE-2024-25002 relates to a command injection in the Bosch Network Synchronizer diagnostics interface. The vulnerability allows unauthorized users to execute commands, potentially attaining full access to the device. Connected sources indicate affected versions are prior to 9.30, but exact vulner...

CVE-2024-25002: Improper Neutralization of Special Elements used in an OS Command

Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device...

Bosch Synchronizer 安全漏洞

Bosch Synchronizer is a network synchronizer from Bosch Germany. A security vulnerability exists in Bosch Synchronizer versions prior to 9.30 that stems from a command injection vulnerability...

PT-2024-20692 · Bosch · Bosch Network Synchronizer

Name of the Vulnerable Software and Affected Versions: Bosch Network Synchronizer affected versions not specified Description: Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device. Recommendations: At the moment, ther...

CSRF Token Reuse Vulnerability

A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform...

PT-2023-3758 · Deviniti · Deviniti Issue Sync Synchronization

Name of the Vulnerable Software and Affected Versions: Deviniti Issue Sync Synchronization version 3.5.2 for Jira Description: The issue is related to information disclosure, allowing a remote attacker to obtain user login credentials by sending a crafted request to the...

CVE-2023-30285: Undefined Security Weakness

An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted request sent to /rest/synchronizer/1.0/technicalUser...

Cross site request forgery (csrf)

@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF Cross-Site Request Forger protection enforced by the @fastify/csrf-protection library, when combined with @fastify/passport in affected versions, can be bypassed by network and same-site attackers...

CSRF token fixation in fastify-passport

The CSRF protection enforced by the @fastify/csrf-protection library, when combined with @fastify/passport, can be bypassed by network and same-site attackers. Details fastify/csrf-protection implements the synchronizer token pattern using plugins @fastify/session and @fastify/secure-session by...

GHSA-2CCF-FFRJ-M4QW CSRF token fixation in fastify-passport

The CSRF protection enforced by the @fastify/csrf-protection library, when combined with @fastify/passport, can be bypassed by network and same-site attackers. Details fastify/csrf-protection implements the synchronizer token pattern using plugins @fastify/session and @fastify/secure-session by...

CVE-2023-29020: Session Fixation

@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF Cross-Site Request Forger protection enforced by the @fastify/csrf-protection library, when combined with @fastify/passport in affected versions, can be bypassed by network and same-site attackers...

SUSE CVE-2011-2224

The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

isync: Multiple Vulnerabilities

Background isync is an IMAP and MailDir mailbox synchronizer. Description Multiple vulnerabilities have been discovered in isync. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaroun...

Owasp CSRFGuard 跨站请求伪造漏洞

Owasp CSRFGuard is a library from the OWASP Owasp Foundation in the United States that implements a variant of the Synchronizer Token Mode to mitigate the risk of cross-site request forgery CSRF attacks. A cross-site request forgery CSRF vulnerability exists in OWASP CSRFGuard 3.1.0 and earlier...

WampServer >= 3.1.3, <= 3.1.8 CSRF Vulnerability

WampServer is prone to a cross-site request forgery CSRF vulnerability. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the...

CVE-2019-11517

WampServer before 3.1.9 has CSRF in addvhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incomplete. An attacker could add/delete any vhosts without the consent of the owner...

CVE-2019-11517

WampServer before 3.1.9 has CSRF in addvhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incomplete. An attacker could add/delete any vhosts without the consent of the owner...