CVE-2024-35207

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The web interface of the affected devices are vulnerable to Cross-Site Request ForgeryCSRF attacks. By tricking an authenticated victim user to click a malicious link, an attacker could perform...

CVE-2024-35207

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The web interface of the affected devices are vulnerable to Cross-Site Request ForgeryCSRF attacks. By tricking an authenticated victim user to click a malicious link, an attacker could perform...

CVE-2024-35207

CVE-2024-35207 affects Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) prior to V1.2. The web interface is vulnerable to Cross-Site Request Forgery (CSRF); an attacker could trick an authenticated user into performing actions on the device without consent. Impact is described as high confiden...

CVE-2024-35207

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The web interface of the affected devices are vulnerable to Cross-Site Request ForgeryCSRF attacks. By tricking an authenticated victim user to click a malicious link, an attacker could perform...

CVE-2024-4535

The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-4531

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as editing cards via CSRF attacks...

PT-2024-31578 · WordPress · Kkprogressbar2 Free

Name of the Vulnerable Software and Affected Versions: KKProgressbar2 Free WordPress plugin versions 1.1.4.2 and earlier Description: The issue concerns the lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unintended actions through CSR...

sensiolabs/connect has a Cross-Site Request Forgery Vulnerability

Versions of sensiolabs/connect prior to 4.2.3 are affected by a Cross-Site Request Forgery CSRF vulnerability due to the absence of the state parameter in OAuth requests. The lack of proper state parameter handling exposes applications to CSRF attacks during the OAuth authentication flow...

CVE-2024-3407 WP Prayer <= 2.0.9 - Arbitrary Prayer Deletion via CSRF

The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

RHEL 6 : mailman (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 - mailman:...

PT-2024-28338 · WordPress · Add Custom Css/Js

Name of the Vulnerable Software and Affected Versions: Add Custom CSS and JS WordPress plugin versions 1.20 and earlier Description: The issue concerns the lack of CSRF checks in certain areas and missing sanitization as well as escaping in the plugin. This could allow attackers to make logged-in...

PT-2024-26774 · WordPress · The Letterpress

Name of the Vulnerable Software and Affected Versions: The LetterPress WordPress plugin versions 1.2.2 and earlier Description: The issue is related to the lack of CSRF checks in some areas, allowing attackers to perform unwanted actions on logged-in users via CSRF attacks, such as deleting...

CVE-2024-3478

The CVE CVE-2024-3478 affects the WordPress plugin Herd Effects. It explains that the plugin, prior to version 5.2.7, lacks CSRF checks in certain bulk actions, enabling a logged-in attacker to coerce an admin into performing unintended actions (e.g., deleting effects) via CSRF attacks. Public so...

CVE-2024-3478 Herd Effects < 5.2.7 - Effect Deletion via CSRF

The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting effects via CSRF attacks...

PT-2024-20254 · WordPress · Float Menu

Name of the Vulnerable Software and Affected Versions: The Float menu WordPress plugin versions prior to 6.0.1 Description: The issue is related to the lack of a CSRF check in the bulk actions of the plugin, which could allow attackers to make logged-in admins delete arbitrary menus via a CSRF...

PT-2024-23507 · WordPress · Enl Newsletter

Name of the Vulnerable Software and Affected Versions: ENL Newsletter WordPress plugin versions 1.0.1 and earlier Description: The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to manipulate logged-in administrators into deleting arbitrary campaigns through...

CVE-2024-2858

The Simple Buttons Creator WordPress plugin through 1.04 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

PT-2024-14945 · WordPress · Wordpress Ping Optimizer

Name of the Vulnerable Software and Affected Versions: WordPress Ping Optimizer plugin versions through 2.35.1.3.0 Description: The issue concerns the lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unwanted actions, such as clearing...

Simple Buttons Creator <= 1.04 - Unauthenticated Stored XSS

Description The plugin does not have any authorisation as well as CSRF in its add button function, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site...

CVE-2024-0856

The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying...