CVE-2018-0785

ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request Forgery Vulnerability"...

CVE-2018-0785

ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request Forgery Vulnerability"...

CVE-2018-0785

CVE-2018-0785 is a CSRF vulnerability in ASP.NET Core 1.0/1.1/2.0 introduced via the ASP.NET Core project templates. The connected data confirms an attacker could change a victim’s account recovery codes, with the MSRC entry describing a cross‑site request forgery affecting template‑created apps ...

CVE-2018-0784

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0808...

CVE-2018-0785: Cross-Site Request Forgery (CSRF)

ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request Forgery Vulnerability"...

CVE-2018-0784: Undefined Security Weakness

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0808...

PT-2018-9065

Name of the Vulnerable Software and Affected Versions: ASP.NET Core versions 1.0 through 2.0 Description: The issue allows an elevation of privilege due to the ASP.NET Core project templates. Recommendations: For ASP.NET Core versions 1.0 through 2.0, at the moment, there is no information about ...

PT-2018-9066

Name of the Vulnerable Software and Affected Versions: ASP.NET Core versions 1.0 through 2.0 Description: A cross-site request forgery issue exists due to the ASP.NET Core project templates. Recommendations: For ASP.NET Core versions 1.0 through 2.0, update to a version that includes the fix for...

ASP.NET Core Elevation Of Privilege Vulnerability

An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests. An attacker who successfully exploited this vulnerability could perform content injection attacks and run script in the security...

ASP.NET Core Cross Site Request Forgery Vulnerabilty

A Cross Site Request Forgery CSRF vulnerability exists when a ASP.NET Core web application is created using vulnerable project templates. An attacker who successfully exploited this vulnerability could change the recovery codes associated with the victim's user account without his/her consent. As...

CVE-2017-1000483

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

World Readable Data

tripleo-heat-templates contains a world readable data vulnerability. The library does not set the proper permissions during the creation of the ceph.client.openstack.keyring, allowing a local user to access the keyring to read or modify data. This vulnerability only affects setups with openstack...

Magento Community Edition and Enterprise Edition Cross-Site Scripting Vulnerability

Magento is an open source PHP e-commerce system from Magento Inc. that provides rights management, search engine, and payment gateway.Magento Community Edition CE is a community edition.Magento Enterprise Edition EE is an enterprise edition. A cross-site scripting vulnerability exists in Magento ...

Format string

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

PYSEC-2018-72

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

CVE-2017-1000483

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

PYSEC-2018-72

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

CVE-2017-1000483

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

Mavenlink: CSRF Add user templates

Reproduction: ========== - Log in to account - Visit CSRF page below note default 30 seconds timeout, can be adjusted according to the connection speed: var a = window.open"https://app.mavenlink.com/projecttemplatesnew", "csrf", "height=100,width=100"; var intervalID = setTimeoutfunction a.close;...

CVE-2017-1000483: Undefined Security Weakness

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...