CVE-2021-41372

A Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF vulnerability exists when Power BI Report Server Template file pbix containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vulnerabilities together, an attacker is able to...

UBUNTU-CVE-2021-39879

Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication...

OpenEMR 跨站请求伪造漏洞

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A cross-site request forgery vulnerability exists in OpenEMR 5.0.2, 6.0.0. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to execute an arbitrary request in...

CVE-2020-3261

A vulnerability in the web-based management interface of Cisco Mobility Express Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based managemen...

Cross site scripting

FreshDNS version 1.0.3 and prior contains a Cross Site Scripting XSS vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted string as their Ful...

[Full-disclosure] Persistent CSRF and The Hotlink Hell

http://www.gnucitizen.org/blog/persistent-csrf-and-the-hotlink-hell/ http://michaeldaw.org/papers/hotlinkpersistentcsrf/ I would like to bring your attention to a topic that has been rarely discussed. I am going to talk about hotlinks, redirections and of course CSRF Cross-site Request Forgery...