Cross site request forgery (csrf)

In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application...

CVE-2020-13658

In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application...

CVE-2020-13658

CVE-2020-13658 affects Lansweeper 8.0.130.17 where the web console is vulnerable to a CSRF attack that enables a low-privilege user to elevate privileges within the application. The vulnerability arises from insufficient CSRF protection in the web interface, leading to unauthorized privilege esca...

CVE-2020-3135

A vulnerability in the web-based management interface of Cisco Unified Communications Manager UCM could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based...

Cross site request forgery (csrf)

A vulnerability in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment HCM-F could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections by the affected...

CVE-2020-3135 Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager UCM could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based...

Cross site request forgery (csrf)

A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF02902.3.01.26 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on a...

RAD SecFlow-1v SF_0290_2.3.01.26 - Cross-Site Request Forgery (Reboot)

Exploit Title: RAD SecFlow-1v SF02902.3.01.26 - Cross-Site Request Forgery Reboot Date: 2020-08-31 Exploit Author: Uriel Yochpaz and Jonatan Schor Vendor Homepage: https://www.rad.com/products/secflow-1v-IIoT-Gateway Version: SecFlow-1v os-image SF02902.3.01.26 Tested on: RAD SecFlow-1v CVE : N/A...

CVE-2020-15789

A vulnerability has been identified in Polarion Subversion Webclient All versions. The web interface could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user, who...

CVE-2020-15789

A vulnerability has been identified in Polarion Subversion Webclient All versions. The web interface could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user, who...

CVE-2019-4688

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

All-Dynamics Software enlogic:show Digital Signage System 2.0.2 Session Fixation

Summary Bring communication with your customers, guests or employees to a new level. You can design content individually and uncomplicated centrally and simply present it in different locations. Whether on large displays, steles, digital signs or on a projector, with enlogic:show your content wil...

CVE-2020-14319

A flaw was found in the AMQ Online console, where it is vulnerable to a Cross-Site Request Forgery attack CSRF, which is exploitable in cases where preflight checks are not instigated or bypassed. This flaw allows an attacker to target authorized users using an older browser with Adobe Flash. The...

The vulnerability of the built-in software of NETGEAR routers such as NETGEAR RBK752, NETGEAR RBK753, NETGEAR RBK753S, NETGEAR RBR750, NETGEAR RBS750, NETGEAR RBK842, NETGEAR RBR840, NETGEAR RBS840, NETGEAR RBK852, NETGEAR RBK853, NETGEAR RBR850, and NETGEAR RBS850 lies in the ability to forge inter-site requests, allowing attackers to carry out CSRF attacks.

The vulnerability of the embedded software of NETGEAR routers such as NETGEAR RBK752, NETGEAR RBK753, NETGEAR RBK753S, NETGEAR RBR750, NETGEAR RBS750, NETGEAR RBK842, NETGEAR RBR840, NETGEAR RBS840, NETGEAR RBK852, NETGEAR RBK853, NETGEAR RBR850, and NETGEAR RBS850 is related to the manipulation ...

CVE-2020-15043

iBall WRB303N devices allow CSRF attacks, as demonstrated by enabling remote management, enabling DHCP, or modifying the subnet range for IP addresses...

CVE-2020-14203

WebFOCUS Business Intelligence 8.0 SP6 allows a Cross-Site Request Forgery CSRF attack against administrative users within the /ibiapps/WFServlet.ibfs endpoint. The impact may be creation of an administrative user. It can also be exploited in conjunction with CVE-2016-9044...

CVE-2020-9042

In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request...

CVE-2020-9042

In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request...

Multi Scheduler <= 1.0.0 - Arbitrary Record Deletion via CSRF

The lack of CSRF check could allow attacker to delete arbitrary records from the plugin for example Professional ones via a CSRF attack. The issue is not patched, and has ben escalated to WP plugins team on May 29th, 2020 PoC The PoC will be displayed once the issue has been remediated...

WordPress: Arbitrary change of blog's background image via CSRF

Description: Despite being deprecated since v3.5.0, the wpsetbackgroundimage method defined in wp-admin/includes/class-custom-background.php, registered as an authenticated AJAX call wpajaxset-background-image, is still active. Given that the method is lacking CSRF checks, an attacker could chang...