PT-2022-7857 · Unknown · Administrate

Name of the Vulnerable Software and Affected Versions: administrate versions 0.1.4 and earlier Description: A cross-site request forgery CSRF issue allows remote attackers to hijack the user's OAuth authorization code. Recommendations: For versions 0.1.4 and earlier, update to a version that fixe...

PT-2022-23714 · Ipswitch · Ws Ftp Server

Name of the Vulnerable Software and Affected Versions: In Progress WS FTP Server versions prior to 8.7.3 Description: The issue concerns forms within the administrative interface that did not include a nonce, which is used to mitigate the risk of cross-site request forgery CSRF attacks. CSRF...

Cross site request forgery (csrf)

The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in admin perform such actions via CSRF attacks...

Cross site request forgery (csrf)

The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks...

WordPress Plugin Hot Linked Image Cacher Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin Hot Linked Image Cacher version 1.16 and prior versions, which stems fro...

WordPress Static Page eXtended plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Static Page eXtended plugin version 2.1 and previous versions have a cross-site scripting...

CVE-2022-1788

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to thi...

Cross site scripting

Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the...

Cross site request forgery (csrf)

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to thi...

CVE-2022-1788

CVE-2022-1788 concerns the WordPress plugin “Change Uploaded File Permissions” (versions <= 4.0.0). The connected sources explicitly describe a CSRF vulnerability due to missing checks that can be exploited to change file and folder permissions across folders, potentially exposing sensitive fi...

CVE-2022-1788 Change Uploaded File Permissions <= 4.0.0 - File Permission Update via CSRF

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to thi...

Admin Management Xtended < 2.4.5 - Multiple CSRF

The plugin does not have CSRF in various places and actions, allowing attackers to make a logged in users perform unauthorised actions on their behalf via CSRF attacks...

GHSA-XC66-MG8R-Q6R5 Apache Wicket vulnerable to CSRF attacks

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided...

Auth0-ASPNET and Auth0-ASPNET-Owin vulnerable to Cross-Site Request Forgery

An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations...

CVE-2022-0916

An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations...

CVE-2022-0916 Broken authentication on Logitech Options due to misvalidation of Oauth state parameter

An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations...

CVE-2022-0141

The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks...

Cross site request forgery (csrf)

The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks...

WordPress Pricing Tables Plugin Cross-Site Request Forgery Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Pricing Tables Plugin versions prior to 3.1.3...

Cross Site Request Forgery in Apache JSPWiki

Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later...