CVE-2024-10892: Cross-Site Request Forgery (CSRF)

The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CISCO-SA-20181017-NEXUS

creationtimestamp| type| source ---|---|--- 2024-12-17 06:41:52+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113666794716343219...

CVE-2024-37774

A Cross-Site Request Forgery CSRF in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an Administrator user to perform sensitive requests in some admin screens...

PT-2024-36320

Name of the Vulnerable Software and Affected Versions: Bastien Ho EELV Newsletter versions prior to 4.8.2 Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows for Cross Site Request Forgery. This is a type of attack where an attacker tricks a user into...

PT-2024-36309

Name of the Vulnerable Software and Affected Versions: Metrika versions n/a through 1.2 Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows for Cross Site Request Forgery. This is a type of attack where an attacker can trick a user into performing unintend...

PT-2024-27415

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields PRO versions prior to 6.3.2 Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application...

PT-2024-36274 · Unknown · Phuc Pham Multiple Admin Emails

Name of the Vulnerable Software and Affected Versions: Phuc Pham Multiple Admin Emails versions n/a through 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows for Cross Site Request Forgery. This affects the multiple admin emails functionality...

PT-2024-36243

Name of the Vulnerable Software and Affected Versions: ThemeFusion Avada versions prior to 7.11.10 Description: A Cross-Site Request Forgery CSRF issue is present in ThemeFusion Avada. This allows an attacker to perform unintended actions on a user's account. Recommendations: For versions prior t...

CVE-2024-31892

IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 could allow a user to perform unauthorized actions after intercepting and modifying a csv file due to improper neutralization of formula elements...

CVE-2024-31892

The CVE-2024-31892 issue affects IBM Storage Scale GUI versions 5.1.9.0–5.1.9.6 and 5.2.0.0–5.2.1.1. Description: a CSV file manipulation path can allow unauthorized actions due to improper neutralization of formula elements, i.e., SQL injection in the GUI. Impact stated in the sources is high (C...

CVE-2024-31892 IBM Storage Scale SQL injection

IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 could allow a user to perform unauthorized actions after intercepting and modifying a csv file due to improper neutralization of formula elements...

CVE-2024-31892 IBM Storage Scale SQL injection

IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 could allow a user to perform unauthorized actions after intercepting and modifying a csv file due to improper neutralization of formula elements...

PT-2024-24271

Name of the Vulnerable Software and Affected Versions IBM Storage Scale GUI versions 5.1.9.0 through 5.1.9.6 IBM Storage Scale GUI versions 5.2.0.0 through 5.2.1.1 Description The issue allows a user to perform unauthorized actions after intercepting and modifying a csv file due to improper...

CVE-2024-31892: Improper Neutralization of Special Elements used in an SQL Command

IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 could allow a user to perform unauthorized actions after intercepting and modifying a csv file due to improper neutralization of formula elements...

OESA-2024-2551 etcd security update

%expand: Security Fixes: Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the...

OESA-2024-2552 etcd security update

%expand: Security Fixes: Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the...

MAL-2024-11834 Malicious code in imran-spotifydl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3800cf40bde01dd8a476c0c1967b5e7bceaf578a40d99d3561a626ba1ef5d24 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Liferay Portal 7.3.2 < 7.4.3.108 CSRF

Cross-site request forgery CSRF vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to 1 change user passwords, 2...

PT-2024-36196

Name of the Vulnerable Software and Affected Versions: NicheAddons Primary Addon for Elementor versions 1.6.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means an attack...

CVE-2024-28141

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the...