Astra Linux – vulnerability in Zabbix

An authenticated user can create a link containing reflected JavaScript code for an item’s page and send it to other users. The payload can only be executed using a known CSRF token value specific to the victim; this value changes periodically and is difficult to predict. The malicious code has...

CVE-2024-48928

Piwigo CVE-2024-48928 affects 14.x branch installations where secret_key is set to MD5(RAND()) in MySQL. RAND() offers about 30 bits of entropy, making brute-forcing feasible within roughly an hour. The CSRF token partially derives from the secret_key, allowing verification of a brute-force attem...