140 matches found
CVE-2023-0737
CVE-2023-0737 : wallabag 2.5.2 is vulnerable to a Cross-Site Request Forgery (CSRF) that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. The issue is fixed in version 2.5.4. Mitigation is to upgrade to 2.5.4 or later.
CVE-2023-0737 CSRF in wallabag/wallabag
wallabag version 2.5.2 contains a Cross-Site Request Forgery CSRF vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4...
PT-2024-11927 · Wallabag · Wallabag
Name of the Vulnerable Software and Affected Versions: wallabag versions 2.5.2 through 2.5.3 Description: The issue allows attackers to arbitrarily delete user accounts via the "/account/delete" endpoint. This is a Cross-Site Request Forgery CSRF vulnerability. Recommendations: For wallabag...
GHSA-56FM-HFP3-X3W3 Wallabag user can disable 2FA unintentionally
Impact wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily disable 2FA through /config/otp/app/disable and /config/otp/email/disable. This vulnerability has a CVSSv3.1 score of 4.3. You should upgrade your instance to version 2.6.7 or higher...
Wallabag user can disable 2FA unintentionally
Impact wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily disable 2FA through /config/otp/app/disable and /config/otp/email/disable. This vulnerability has a CVSSv3.1 score of 4.3. You should upgrade your instance to version 2.6.7 or higher...
PT-2023-32979 · Wallabag · Wallabag
Name of the Vulnerable Software and Affected Versions: wallabag versions prior to 2.6.7 Description: The issue allows attackers to arbitrarily disable 2FA through "config/otp/app/disable" and "config/otp/email/disable" API endpoints. Recommendations: For versions prior to 2.6.7, upgrade your...
Cross-Site Request Forgery (CSRF)
wallabag/wallabag is vulnerable to Cross-Site Request Forgery CSRF. Through the use of a malicious GET request to the /reset/annotations, /reset/entries, /reset/tags, or /reset/archived endpoints, an attacker is able to arbitrary reset annotations, entries, and tags...
Cross-Site Request Forgery (CSRF)
wallabag/wallabag is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in the deleteClientAction function of DeveloperController.php as it does not properly validate the CSRF token, which allows an attacker to arbitrarily delete the API key by sending a GET request to the...
Cross-Site Request Forgery (CSRF)
wallabag/wallabag is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists due to the lack of a CSRF token in the resetAction function of ConfigController.php, which allows an attacker to arbitrarily delete the victim user's annotations, entries and tags by sending GET requests ...
Wallabag user can reset data unintentionally
Description wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily reset annotations, entries and tags, by the GET request to /reset/annotations, /reset/entries, /reset/tags, /reset/archived. This vulnerability has a CVSSv3.1 score of 4.3. You...
GHSA-P8GP-899C-JVQ9 Wallabag user can reset data unintentionally
Description wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily reset annotations, entries and tags, by the GET request to /reset/annotations, /reset/entries, /reset/tags, /reset/archived. This vulnerability has a CVSSv3.1 score of 4.3. You...
Wallabag user can delete own API client unintentionally
Description wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily delete API key via /developer/client/delete/id This vulnerability has a CVSSv3.1 score of 6.5. You should immediately patch your instance to version 2.6.3 or higher if you have...
GHSA-GJVC-55FW-V6VQ Wallabag user can delete own API client unintentionally
Description wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily delete API key via /developer/client/delete/id This vulnerability has a CVSSv3.1 score of 6.5. You should immediately patch your instance to version 2.6.3 or higher if you have...
Duplicate Advisory: Wallabag user can reset data unintentionally
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p8gp-899c-jvq9. This link is maintained to preserve external references. Original Description Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...
Duplicate Advisory: Wallabag user can delete own API client unintentionally
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gjvc-55fw-v6vq. This link is maintained to preserve external references. Original Description Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...
GHSA-GVVX-FC6P-2H9X Duplicate Advisory: Wallabag user can delete own API client unintentionally
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gjvc-55fw-v6vq. This link is maintained to preserve external references. Original Description Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...
GHSA-RWPG-4C4C-V3R4 Duplicate Advisory: Wallabag user can reset data unintentionally
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p8gp-899c-jvq9. This link is maintained to preserve external references. Original Description Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...
CVE-2023-4455
Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...
