PT-2023-19898 · Unknown · Denishua Comment Reply Notification

Name of the Vulnerable Software and Affected Versions: Denishua Comment Reply Notification plugin versions = 1.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions o...

PT-2023-25542 · Unknown · Pos Codekop

Name of the Vulnerable Software and Affected Versions: POS Codekop version 2.0 Description: A Cross-Site Request Forgery CSRF issue allows attackers to escalate privileges. Recommendations: For POS Codekop version 2.0, consider implementing proper CSRF token validation to prevent unauthorized...

CVE-2022-3372

There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel,...

CVE-2023-31200

PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack...

Cross site request forgery (csrf)

PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack...

Cross-Site Request Forgery Token Validation Bypass

Cross-Site Request Forgery CSRF vulnerabilities remediation usually rely on the usage of CSRF tokens which are sensitive and unpredictable values shared between the web application sever and the clients. When performing sensitive or privileged actions like submitting some forms for example, CSRF...

PT-2023-15057 · Unknown · Kodex Posts Likes Plugin

Name of the Vulnerable Software and Affected Versions: Kodex Posts likes plugin versions = 2.4.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-20092 · Unknown · Csaba Kissi About Me 3000 Widget Plugin

Name of the Vulnerable Software and Affected Versions: Csaba Kissi About Me 3000 widget plugin versions = 2.2.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on...

PT-2023-15225 · WordPress · Stylistwp Extra Block Design

Name of the Vulnerable Software and Affected Versions: StylistWP Extra Block Design, Style, CSS for ANY Gutenberg Blocks plugin versions 0.2.6 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended...

If the controller for _data.projectId is not defined, it can lead to incorrect execution of _swap() and theft of funds by the beneficiary.

Lines of code Vulnerability details Impact If the controller is not defined in the swap function, then it becomes impossible to mint and burn tokens, which leads to incorrect execution of the function. IJBController controller = IJBControllerjbxTerminal.directory.controllerOfdata.projectId; Proof...

Strapi 授权问题漏洞

Strapi is an open source content management system CMS. A security vulnerability exists in Strapi versions prior to 4.5.5 that stems from the fact that Strapi does not validate access or ID tokens issued during the OAuth process when the AWS Cognito login provider is used for authentication...

PT-2023-20820 · Opencats · Opencats

Name of the Vulnerable Software and Affected Versions: OpenCATS version 0.9.7 Description: A Cross-Site Request Forgery CSRF issue allows attackers to force users into submitting web requests via unspecified vectors. Recommendations: For OpenCATS version 0.9.7, consider implementing anti-CSRF...

CVE-2023-1751

The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the device attempting to associate. This could allow any authorized user to receive alarm information and signals meant for other devices which...

CVE-2023-1751 CVE-2023-1751

The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the device attempting to associate. This could allow any authorized user to receive alarm information and signals meant for other devices which...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Stored XSS via Kroki diagram Prometheus integration Google IAP details are not hidden, may leak account details from instance/group/project settings Improper validation of SSO and SCIM tokens while managing groups Maintainer can leak Datadog API key by changing Datadog site...

Internet Bug Bounty: JWT audience claim is not verified

An improper authorization vulnerability existed in all versions of Argo CD starting with v1.8.2, allowing the API to accept certain invalid tokens due to the lack of validation of the audience claim in signed tokens. This could allow an attacker to use a stolen token intended for a different...

PT-2023-16704 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: Froxlor versions prior to 2.0.11 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository froxlor/froxlor. This type of attack forces a user to execute unintended actions on a web application that they are...

SUSE CVE-2012-4456

The 1 OS-KSADM/services and 2 tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services...

SUSE CVE-2016-4430

Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery CSRF attacks via unspecified vectors...

SUSE CVE-2022-29226

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current...