1855 matches found
Cross site request forgery (csrf)
A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack to manipulate an authenticated user into executing malicious actions without their awareness or consent. The...
Cross site request forgery (csrf)
Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need t...
PT-2021-11732
Name of the Vulnerable Software and Affected Versions: Vert.x-Web framework versions 4.0 milestone 1 through 4.0 milestone 4 Description: The issue arises from incorrect CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, the framework compares...
PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)
Exploit Title: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery Delete admin shoutbox message Date: 2020-12-21 Exploit Author: Mohamed Oosman B S Vendor Homepage: https://www.php-fusion.co.uk/ Software Link: https://www.php-fusion.co.uk/phpfusion9downloads.php Version: 9.03.90 and below Tested...
CVE-2020-35687
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim...
Cross site request forgery (csrf)
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim...
PT-2021-11960 Ā· Unknown Ā· Jupyterhub
Name of the Vulnerable Software and Affected Versions: JupyterHub version 1.1.0 Description: The issue allows for CSRF in the admin panel via a request that lacks an xsrf field. This can be demonstrated by a "/hub/api/user" request, which can be used to add or remove a user account...
PT-2020-6956 Ā· WordPress Ā· Wp-Postratings
Name of the Vulnerable Software and Affected Versions: WP-PostRatings WordPress plugin versions prior to 1.86.1 Description: The issue is related to the WP-PostRatings WordPress plugin and involves a lack of sanitization of the postratings image parameter from its options page, specifically at th...
Redux Framework < 4.1.21 - CSRF Nonce Validation Bypass
The plugin did not properly validate some nonces, only checking them if their value was set. As a result, CSRF attacks could still be performed by not submitting the nonce in the request, bypassing the protection they are supposed to provide. PoC Just don't send the parameters: $POST'nonce' or...
Cross site request forgery (csrf)
A vulnerability has been identified in XHQ All Versions 6.1. The web interface could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link...
OpenCart 3.0.3.6 - Cross Site Request Forgery
Exploit Title: OpenCart 3.0.3.6 - Cross Site Request Forgery Date: 12-11-2020 Exploit Author: Mahendra Purbia Mah3Sec Vendor Homepage: https://www.opencart.com Software Link: https://www.opencart.com/index.php?route=cms/download Version: OpenCart CMS - 3.0.3.6 Tested on: Kali Linux Description:...
CVE-2020-26936
Cloudera Data Engineering CDE before 1.1 was vulnerable to a CSRF attack...
CVE-2020-26936
Cloudera Data Engineering CDE before 1.1 was vulnerable to a CSRF attack...
Ubuntu: Security Advisory (USN-4639-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
This One Time on a Pen Test: CSRF to Password Reset Phishing
Each year, Rapid7 penetration testers complete hundreds of internally and externally based penetration testing service engagements. This post is part of an ongoing series featuring testimonials of what goes on beneath the hoodie. For more insights, check out our 2020 Under the Hoodie report...
Cross site request forgery (csrf)
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions 15.2.1, 14.15.1, and 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and...
CVE-2020-28040
WordPress before 5.5.2 allows CSRF attacks that change a theme's background image...
CVE-2020-28040
WordPress before 5.5.2 allows CSRF attacks that change a theme's background image...
CVE-2020-28040
WordPress before 5.5.2 allows CSRF attacks that change a theme's background image...
Critical Flaws Discovered in Popular Industrial Remote Access Systems
Cybersecurity researchers have found critical security flaws in two popular industrial remote access systems that can be exploited to ban access to industrial production floors, hack into company networks, tamper with data, and even steal sensitive business secrets. The flaws, discovered by Tel...