4515 matches found
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: from n/a through 1.0.4...
CVE-2024-24935
CVE-2024-24935 is a CSRF vulnerability in the WordPress plugin WpSimpleTools Basic Log Viewer (Basic Log Viewer). Affected version range is up to and including 1.0.4 . The CVE entry notes a CSRF risk that could enable unauthorized actions, but the provided connected documents indicate the vulnera...
CVE-2024-24935 WordPress Basic Log Viewer Plugin <= 1.0.4 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: from n/a through 1.0.4...
PT-2024-20673 · Unknown · Wpsimpletools Basic Log Viewer
Name of the Vulnerable Software and Affected Versions: WpSimpleTools Basic Log Viewer versions 1.0.4 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Basic Log Viewer, allowing unauthorized actions to be performed. Recommendations: For versions 1.0.4 and earlier, updat...
WordPress Plugin Basic Log Viewer Cross-Site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...
Basic Log Viewer <= 1.0.4 - Cross-Site Request Forgery via wpst_lw_viewer
Description The Basic Log Viewer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the 'wpstlwviewer' function. This makes it possible for unauthenticated attackers to erase error logs...
WordPress Basic Log Viewer Plugin <= 1.0.4 is vulnerable to Cross Site Request Forgery (CSRF)
Software Basic Log Viewer Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24935 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5f0c62583a0d Credits Dhabaleshwar Das...
Mobotix S14 Camera Cleartext Transmission of Sensitive Information (CVE-2019-7675)
An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. The default management application is delivered over cleartext HTTP with Basic Authentication, as demonstrated by the /admin/index.html URI. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-o...
(Pwn2Own) Canon imageCLASS MF753Cdw rls-login Authorization Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF753Cdw printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the Authorization header provided to the...
[SECURITY] Fedora 39 Update: systemd-254.8-2.fc39
systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses sock et and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...
CVE-2023-6554
When access to the "admin" folder is not protected by some external authorization mechanisms e.g. Apache Basic Auth, it is possible for any user to download protected information like exam answers...
CVE-2023-6554
When access to the "admin" folder is not protected by some external authorization mechanisms e.g. Apache Basic Auth, it is possible for any user to download protected information like exam answers...
Design/Logic Flaw
When access to the "admin" folder is not protected by some external authorization mechanisms e.g. Apache Basic Auth, it is possible for any user to download protected information like exam answers...
CVE-2023-6554
CVE-2023-6554 affects Tecnick TCExam (admin folder). The root cause is insufficient external authorization protection in the admin directory, allowing any user to download protected information such as exam answers when access is not gated by mechanisms like Apache Basic Auth. Impact is confident...
CVE-2023-29447
An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication...
Design/Logic Flaw
An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication...
CVE-2023-29447
CVE-2023-29447 concerns an insubstantial protection of credentials in PTC Kepware KepServerEX, where the web server uses basic authentication. The Red Hat/NVD entries confirm the vulnerability in KepServerEX and describe that an attacker could capture credentials, potentially enabling a MitM scen...
UAC-0099 Using WinRAR Exploit to Target Ukrainian Firms with LONEPAGE Malware
The threat actor known as UAC-0099 has been linked to continued attacks aimed at Ukraine, some of which leverage a high-severity flaw in the WinRAR software to deliver a malware strain called LONEPAGE. "The threat actor targets Ukrainian employees working for companies outside of Ukraine,"...
Dell BIOS Security Vulnerability
Dell BIOS is embedded software on a small memory chip on a computer motherboard from Dell USA. A security vulnerability exists in Dell BIOS, which stems from pre-boot direct access to memory, and can be exploited by an attacker to execute arbitrary code on the device...