Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Feature Set module for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable or 2 disable a module via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors...

CVE-2015-3380

CVE-2015-3380 concerns the Drupal Feature Set contributed module. A CSRF flaw allows remote attackers to cause an administrator to enable or disable modules via crafted requests, compromising admin actions. Affected: Feature Set module for Drupal (all versions prior to fixed release). Root cause:...

CVE-2015-3388

Cross-site request forgery CSRF vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors...

CVE-2015-3352

Multiple cross-site request forgery CSRF vulnerabilities in the Jammer module before 6.x-1.8 and 7.x-1.x before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete a setting for 1 hidden form elements or 2 status messages via unspecifi...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Jammer module before 6.x-1.8 and 7.x-1.x before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete a setting for 1 hidden form elements or 2 status messages via unspecifi...

CVE-2015-3354

The CVE-2015-3354 entry concerns the Drupal Wishlist module (versions 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7). The vulnerability is a CSRF flaw that allows remote attackers to hijack the authentication of arbitrary users to perform actions deleting wishlist purchase intentions via unsp...

CVE-2015-3349

The CVE-2015-3349 entry concerns Drupal’s Htaccess module (7.x-2.x) with CSRF flaws that allow remote attackers to hijack administrator sessions to deploy or delete an .htaccess file. Affected: Htaccess module for Drupal 7.x, prior to 7.x-2.3. Root cause: Cross-site request forgery in the module’...

CVE-2015-3370

Cross-site request forgery CSRF vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the authentication of users with the "nodeinvitecanmanageinvite" permission for requests that re-enable node invitations via unspecified vectors...

CVE-2015-3363

Cross-site request forgery CSRF vulnerability in the Contact Form Fields module before 6.x-2.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete fields via unspecified vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Landesk Management Suite 9.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 start, 2 stop, or 3 restart services via a request to remote/serverServices.aspx...

PT-2015-6168

Name of the Vulnerable Software and Affected Versions Cloudwords for Multilingual Drupal module versions prior to 7.x-2.3 Description The issue is related to a cross-site request forgery CSRF vulnerability, which allows remote attackers to hijack the authentication of victims via an unknown menu...

CVE-2015-0970

Cross-site request forgery CSRF vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users...

CVE-2015-0970

SearchBlox (enterprise search on Lucene) is affected by a CSRF vulnerability (CVE-2015-0970) in versions before 8.2. A remote attacker can hijack the authentication of an arbitrary user by inducing an authenticated user to trigger a malicious request. The issue is confirmed across multiple source...

CVE-2015-2940

Cross-site request forgery CSRF vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors...

CVE-2015-2940

Cross-site request forgery CSRF vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors...

CVE-2015-2940

CVE-2015-2940 is a CSRF flaw in the MediaWiki CheckUser extension that can allow a remote attacker to hijack a user’s session and retrieve sensitive information. The connected advisories corroborate this as part of multiple vulnerabilities affecting MediaWiki, with remediation guidance to upgrade...

CVE-2015-2295

Cross-site request forgery CSRF vulnerability in systemfirmwarerestorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter...

CVE-2015-2838

CVE-2015-2838 affects Citrix NetScaler Nitro API prior to 10.5 build 52.3nc. The vulnerability arises from CSRF that lets an attacker craft requests via the file_name JSON field in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix, enabling shell metacharacters to execute commands as nsroot. This...

CVE-2015-0259

OpenStack Compute Nova before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage...