1613 matches found
Cross site request forgery (csrf)
phpBB 3.2.8 allows a CSRF attack that can modify a group avatar...
CVE-2020-5501
phpBB 3.2.8 allows a CSRF attack that can modify a group avatar...
CVE-2020-5501
CVE-2020-5501 affects phpBB 3.2.8, where a cross-site request forgery (CSRF) vulnerability allows an attacker to modify a group avatar. The description and corroborating records (Red Hat, OSV, GHSA entries, CNVD, and CVE listings) consistently identify the impact as avatar modification via CSRF. ...
PT-2020-18482 · Phpbb Limited · Phpbb
Name of the Vulnerable Software and Affected Versions: phpBB version 3.2.8 Description: The issue allows for a CSRF attack, which can be used to modify a group avatar. Recommendations: For phpBB version 3.2.8, update to a newer version that contains a fix for this issue...
BuddyPress < 5.1.1 - Denial of Service
A denied of service was fixed that could allow a logged in user to remove another user’s avatar and also any empty folder...
vBulletin 5.0 5.5.4 - updateAvatar Authenticated Remote Code Execution
vBulletin 5.0 5.5.4 - updateAvatar Authenticated Remote Code Execution ?php / --------------------------------------------------------------------- vBulletin = 5.5.4 updateAvatar Remote Code Execution Vulnerability ---------------------------------------------------------------------...
CVE-2019-17132
vBulletin through 5.5.4 mishandles custom avatars...
CVE-2019-13376
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...
CVE-2019-13376
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...
Cross site request forgery (csrf)
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...
UBUNTU-CVE-2019-13376
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...
CVE-2019-13376
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...
CVE-2019-13376
CVE-2019-13376 affects phpBB version 3.2.7. The vulnerability arises from CSRF in the Remote Avatar feature, enabling token hijacking that can steal an Administration Control Panel session ID and leads to stored XSS. The connected documents corroborate the affected component and the root cause (C...
Mail.ru: Delete images of users with clickjacking in https://pw.mail.ru
Researcher found site-wide Clickjacking on https://pw.mail.ru which potentially could be used to trick user to delete avatar or change his/her profile data...
CloudBees Jenkins Avatar Plugin Authorization Issue Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . An authorization issue vulnerability exists in CloudBees Jenkins Avatar Plugin. An attacker can exploit this vulnerability to perform modification operations on...
Mail.ru: Avatar upload allows arbitrary file overwriting
Directory traversal via filename extension for avatar upload allowed to overwrite arbitrary files in S3-compatible bucket for static files in pandao.ru. Pandao.ru belongs to extended scope...
CVE-2019-10377
A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins...
CVE-2019-10377
A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins...