CVE-2023-50349

Sametime is impacted by a Cross Site Request Forgery CSRF vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application...

Cross site request forgery (csrf)

Sametime is impacted by a Cross Site Request Forgery CSRF vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application...

CVE-2023-50349 HCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability

Sametime is impacted by a Cross Site Request Forgery CSRF vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application...

HCL Sametime Cross-Site Request Forgery Vulnerability

HCL Technologies HCL Sametime is a conferencing solution from HCL Technologies, USA. A cross-site request forgery vulnerability exists in HCL Sametime. An attacker could exploit this vulnerability to perform a cross-site request forgery attack...

CVE-2024-20252

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an unauthenticated, remote attacker to conduct cross-site request forgery CSRF attacks that perform arbitrary actions on an affected device. Note: "Cisco Expressway Series" refers...

Cross site request forgery (csrf)

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an unauthenticated, remote attacker to conduct cross-site request forgery CSRF attacks that perform arbitrary actions on an affected device. Note: "Cisco Expressway Series" refers...

PT-2024-20502 · Wp-Cfm · Wp-Cfm

Name of the Vulnerable Software and Affected Versions: WP-CFM versions 1.7.8 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Forum One WP-CFM wp-cfm, allowing unauthorized actions to be performed on behalf of a user without their knowledge or consent. Recommendations:...

Cisco Expressway Series 跨站请求伪造漏洞

Cisco Expressway Series is an American Cisco software for accessing devices outside the firewall. A cross-site request forgery vulnerability exists in Cisco Expressway Series, which can be exploited by an attacker to obtain sensitive information or perform unauthorized operations...

CVE-2023-47889

The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers. These exposed actions can allow any app on the device to send unauthorized broadcasts, leading to unintended consequences. The vulnerability is particularly...

CVE-2023-47889

The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers. These exposed actions can allow any app on the device to send unauthorized broadcasts, leading to unintended consequences. The vulnerability is particularly...

CVE-2024-0796

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6.1. This is due to missing or incorrect nonce validation on several functions corresponding to...

Cross site request forgery (csrf)

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6.1. This is due to missing or incorrect nonce validation on several functions corresponding to...

Debug < 1.11 - CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in admins perform unwanted actions, such as clear logs, via CSRF attacks...

WhatsUp Gold 2022 (22.1.0 Build 39) - XSS

Exploit Title: WhatsUpGold 22.1.0 - Stored Cross-Site Scripting XSS Date: April 18, 2023 Exploit Author: Andreas Finstad 4ndr34z Vendor Homepage: https://www.whatsupgold.com Version: v.22.1.0 Build 39 Tested on: Windows 2022 Server CVE : CVE-2023-35759 Reference:...

WhatsUp Gold 2022 (22.1.0 Build 39) - XSS Vulnerability

Exploit Title: WhatsUpGold 22.1.0 - Stored Cross-Site Scripting XSS Exploit Author: Andreas Finstad 4ndr34z Vendor Homepage: https://www.whatsupgold.com Version: v.22.1.0 Build 39 Tested on: Windows 2022 Server CVE : CVE-2023-35759 Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-35759 WhatsU...

PT-2024-15872 · WordPress · Affiliates Manager

Name of the Vulnerable Software and Affected Versions: Affiliates Manager plugin for WordPress versions up to, and including, 2.9.34 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the process bulk action function in...

Argus - A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions

This repo contains the code for our USENIX Security '23 paper "ARGUS: A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions". Argus is a comprehensive security analysis tool specifically designed for GitHub Actions. Built with an aim to enhance the security of CI/CD...

U.S. Dept Of Defense: Attacker can Add itself as admin user and can also change privileges of Existing Users [█████████]

The website had a directory that lacked authentication, allowing an attacker to add a new admin user and change the privileges of existing users without any authentication...

Accessibility < 1.0.7 - Cross-Site Request Forgery

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administrator into performing an action such as...

CVE-2024-24757

open-irs is an issue response robot that reponds to issues in the installed repository. The .env file was accidentally uploaded when working with git actions. This problem is fixed in 1.0.1. Discontinuing all sensitive keys and turning into secrets...