Atlassian Jira < 8.13.15 / 8.14.x < 8.20.3 / 8.21.0 XSRF (JRASERVER-73073)

The version of Atlassian Jira installed on the remote host is prior to 8.13.15 / 8.14.x 8.20.3 / 8.21.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-73073 advisory. - jira-importers-plugin has misconfigured XSRF protection - CVE-2021-43941 CVE-2021-43941 Note that...

Atlassian Jira < 8.13.16 / 8.14.x < 8.20.5 / 8.21.0 XSRF (JRASERVER-73170)

The version of Atlassian Jira installed on the remote host is prior to 8.13.16 / 8.14.x 8.20.5 / 8.21.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-73170 advisory. - CSRF allows toggling Thread Contention and CPU Monitoring - CVE-2021-43953 CVE-2021-43953 Note th...

Paymoney 3.3 Cross Site Scripting Vulnerability

Title: paymoney-3.3 XSS-Reflected Author: nu11secur1ty Vendor: https://paymoney.techvill.org/ Software: paymoney-3.3 Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/paymoney/2022/paymoney-3.3 Description: The parameters firstname and lastname in Users are vulnerable...

Paymoney 3.3 Cross Site Scripting

Title: paymoney-3.3 XSS-Reflected Author: nu11secur1ty Date: 07.02.2022 Vendor: https://paymoney.techvill.org/ Software: paymoney-3.3 Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/paymoney/2022/paymoney-3.3 Description: The parameters firstname and lastname in User...

Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests...

GHSA-8VPW-MGPF-MPVV Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests...

Laravel Framework RCE Vulnerability

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in...

GHSA-QVQM-H22R-4CP9 Laravel Framework RCE Vulnerability

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in...

SAP BusinessObjects Business Intelligence Platform XSRF (3130497)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by a cross site request forgery XSRF vulnerability. An XSRF token visible in the URL may lead to information disclosure. Note that Nessus has not attempted to exploit these issues bu...

Cisco SD-WAN vManage Software XSRF (cisco-sa-sdwan-vmanage-csrf-rxQL4tXR)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an...

Atlassian Jira < 8.13.18 / 8.14.x < 8.20.6 / 8.21.0 XSRF (JRASERVER-73138)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is affected by a cross-site request forgery XSRF vulnerability. Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default...

Atlassian Jira Server jira-importers-plugin跨站请求伪造漏洞

Atlassian Jira Service is the server version of an IT service desk and request tracking system from Atlassian Australia. Atlassian Jira Server jira-importers-plugin is vulnerable to cross-site request forgery, which stems from jira-importers-plugin being misconfigured with XSRF protection. An...

Mageia: Security Advisory (MGASA-2017-0471)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulnerabilities fixed in Liferay Portal

Vulnerabilities have been fixed in Liferay Portal. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS. Manipulation of data Circumvention of security measure...

Shenzhen Skyworth RN510 Cross Site Request Forgery / Cross Site Scripting

Overview ======== Title:- Authenticated XSRF in RN510 Mesh Extender. CVE-ID :- CVE-2021-25327 Author: Kaustubh G. Padwad Vendor: Shenzhen Skyworth Digital Technology Company Ltd.http://www.skyworthdigital.com/products Products: 1. RN510 with firmware V.3.1.0.4 Tested and verified Potential 2.RN62...

Unauthenticated users can inject messages into the XSRF token error page

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to display arbitrary messages in the application via an injection vulnerability in the XSRF token error page. The affected versions are before version 8.5.14, and from version 8.6.0 before 8.12.1. ...

Unauthenticated users can inject messages into the XSRF token error page

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to display arbitrary messages in the application via an injection vulnerability in the XSRF token error page. The affected versions are before version 8.5.14, and from version 8.6.0 before 8.12.1. ...

CVE-2021-25327

Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery CSRF vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp. Missing CSRF protection in devices can lead to XSRF, as the above pages are vulnerable to cross-site scripting XSS...

CVE-2021-25327

The CVE-2021-25327 entry concerns Skyworth RN510 (Firmware V.3.1.0.4). A CSRF vulnerability exists in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp due to missing CSRF protection, with the description noting potential XSRF tied to XSS-prone pages. Connected sources corroborate the affe...

Unibox Cross Site Request Forgery

===================================================== Authenticated XSRF leads to complete Account Takeover ===================================================== . contents:: Table Of Content Overview ======== Title:- Authenticated XSRF leads to complete account takeover in all UNIBOX WiFi Hotspo...