CVE-2024-43116: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10...

PT-2024-30303 · WordPress · Simple Local Avatars

Name of the Vulnerable Software and Affected Versions: Simple Local Avatars versions 2.7.10 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Simple Local Avatars plugin. This allows an attacker to perform unintended actions on a user's account. The estimated number of...

Kliqqi CMS 安全漏洞

Kliqqi CMS Pligg CMS is Kliqqi open source a content management system . Kliqqi CMS v2.0.2 version of the cross-site request forgery vulnerability , the vulnerability stems from /admin/adminbackup.php?dobackup=avatars do not adequately verify that the request is from a trusted user , an attacker...

CVE-2024-42609

Pligg CMS v2.0.2 is affected by a CSRF vulnerability exposed via /admin/admin_backup.php?dobackup=avatars. The connected documents confirm the vulnerability type and affected version, but do not provide an official patch details within the supplied sources. Some sources (PT-2024-30061) mention a ...

CVE-2024-42609

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/adminbackup.php?dobackup=avatars...

PT-2024-30061 · Pligg Cms · Pligg Cms

Name of the Vulnerable Software and Affected Versions: Pligg CMS version 2.0.2 Description: A Cross-Site Request Forgery CSRF issue was found in Pligg CMS. The vulnerability is exploited via the "/admin/admin backup.php?dobackup=avatars" API endpoint. Recommendations: For Pligg CMS version 2.0.2,...

CVE-2024-42609: Cross-Site Request Forgery (CSRF)

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/adminbackup.php?dobackup=avatars...

WordPress Simple Local Avatars plugin <= 2.7.10 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Simple Local Avatars versions = 2.7.10...

WordPress Simple Local Avatars Plugin <= 2.7.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software Simple Local Avatars Type Plugin Vulnerable versions = 2.7.10 Fixed in 2.7.11 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43116 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0c02a424f233 Credits Rafie Muhamm...

Malicious code in sap-avatars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b301ccb5a00338d349f0dbbbd8bd410f27e2298aa7885407ab9b2e404b16429e The OpenSSF Package Analysis project identified 'sap-avatars' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7597 Malicious code in sap-avatars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b301ccb5a00338d349f0dbbbd8bd410f27e2298aa7885407ab9b2e404b16429e The OpenSSF Package Analysis project identified 'sap-avatars' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-31610

File Upload vulnerability in the function for employees to upload avatars in Code-Projects Simple School Management System v1.0 allows attackers to run arbitrary code via upload of crafted file...

CVE-2024-24756

CVE-2024-24756 is a path traversal vulnerability in Crafatar. Affected: Crafatar versions prior to 2.1.5, including Docker deployments; Cloudflare-protected or external CDN setups are not affected. The issue allows requesting files outside the lib/public directory from within the container, with ...

CVE-2024-24756 Crafatar path traversal vulnerability

Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the lib/public/ directory can be requested from the server. Instances running behind Cloudflare including crafatar.com are not affected. Instances using the Docker container as shown in the READ...

Server side request forgery (ssrf)

Appwrite = v1.4.13 is affected by a Server-Side Request Forgery SSRF via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159...

Appwrite Code Issue Vulnerability

Appwrite is Appwrite open source an end-to-end backend server . It is used to package web, mobile, native or backend applications as a set of Docker microservices. A security vulnerability exists in Appwrite v1.4.13 and earlier versions, which stems from a discovery via the /v1/avatars/favicon...

CVE-2024-1063: Server-Side Request Forgery (SSRF)

Appwrite = v1.4.13 is affected by a Server-Side Request Forgery SSRF via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159...

CVE-2024-23790

Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1...

Input validation

Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1...

CVE-2024-23790

CVE-2024-23790 describes an Improper Input Validation vulnerability in OTRS avatar upload, caused by missing filetype checks. Affected product versions are: OTRS 7.0.X up to 7.0.48, OTRS 8.0.X up to 8.0.37, and OTRS released in 2023 up to 2023.1.1. Public details in the connected PT-Security advi...