Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in LOGITEC LAN-W300N/RS allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted...

CVE-2021-20636

CVE-2021-20636 affects LOGITEC LAN-W300N/PR5B with a CSRF flaw that lets an attacker hijack administrator sessions via a specially crafted URL, potentially causing unintended device setting changes. The connected sources (Red Hat advisory, JVN entries, and CVE lists) confirm the vulnerability and...

CVE-2020-26183

Dell EMC NetWorker versions prior to 19.3.0.2 contain an improper authorization vulnerability. Certain remote users with low privileges may exploit this vulnerability to perform 'nsrmmdbd' operations in an unintended manner...

JVN#25422698: SKYSEA Client View vulnerable to privilege escalation

SKYSEA Client View provided by Sky Co., LTD. is an Enterprise IT Asset Management Tool. SKYSEA Client View contains a privilege escalation vulnerability CWE-268. Impact A user who can login to the PC where the product is installed may obtain unauthorized privileges and modify/obtain sensitive...

JVN#05502028: WordPress Plugin "Social Sharing Plugin" vulnerable to cross-site request forgery

WordPress Plugin "Social Sharing Plugin" provided by Social Rocket contains a cross-site request forgery vulnerability CWE-352. Impact If a user with an administrative privilege views a malicious page while logged in, unintended operations may be performed. Solution Update the plugin Update the...

JVN#89224521: Multiple vulnerabilities in EasyBlocks IPv6

EasyBlocks IPv6 provided by Plat'Home Co., Ltd. contains multiple vulnerabilities listed below. Cross site request forgeryCWE-352 - CVE-2020-5549 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N| Base Score: 4.3 CVSS v2| AV:N/AC:H/Au:N/C:N/I:P/A:N| Base...

JVN#26847507: Multiple vulnerabilities in "Custom Body Class"

WordPress Plugin "Custom Body Class" provided by Andrei Lupu contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2019-6029 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:H/Au:N/C:N/I:P/A:N|...

JVN#26838191: WordPress Plugin "WP Spell Check" vulnerable to cross-site request forgery

WordPress Plugin "WP Spell Check" provided by WP Spell Check contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the plugin Update the plugin according to the information...

JVN#49575131: WordPress Plugin ”HTML5 Maps” vulnerable to cross-site request forgery

WordPress Plugin ”HTML5 Maps” provided by Fla-Shop.com contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the plugin Update the plugin according to the information provided b...

CVE-2018-16161

OpenDolphin 2.7.0 and earlier allows authenticated users to gain administrative privileges and perform unintended operations...

Code injection

OpenDolphin 2.7.0 and earlier allows authenticated users to gain administrative privileges and perform unintended operations...

CVE-2018-16161

OpenDolphin 2.7.0 and earlier allows authenticated users to gain administrative privileges and perform unintended operations...

JVN#71329812: WL-330NUL vulnerable to cross-site request forgery

WL-330NUL provided by ASUS Japan Inc. is a portable wireless LAN router. WL-330NUL contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in the management screen, unintended operations may be performed on the device. Solution Update the...

JVN#83834277: Multiple vulnerabilities in FS010W

FS010W provided by FUJI SOFT INCORPORATED is a WiFi router. FS010W contains multiple vulnerabilities listed below. Stored cross-site scripting CWE-79 - CVE-2018-0519 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N| Base Score: 4.3 CVSS v2|...

JVN#91393903: Multiple vulnerabilities in epg search result viewer(kkcald)

epg search result viewerkkcald provided by kkcal contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2018-0508 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:M/AU:N/C:N/I:P/A:N| Base Score:...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows remote attackers to hijack the authentication of a logged in user to perform unintended operations via unspecified vectors...

CVE-2016-7809

Cross-site request forgery CSRF vulnerability in Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows remote attackers to hijack the authentication of logged in user to conduct unintended operations via unspecified vectors...

CVE-2016-7822

Cross-site request forgery CSRF vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows remote attackers to hijack the authentication of a logged in user to perform unintended operations via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to hijack the authentication of a user to perform unintended operations via unspecified vectors...

Code injection

The Android Apps Money Forward prior to v7.18.0, Money Forward for The Gunma Bank prior to v1.2.0, Money Forward for SHIGA BANK prior to v1.2.0, Money Forward for SHIZUOKA BANK prior to v1.4.0, Money Forward for SBI Sumishin Net Bank prior to v1.6.0, Money Forward for Tokai Tokyo Securities prior...