Cross site request forgery (csrf)

Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery CSRF token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7....

SUSE SLES12 Security Update : zabbix (SUSE-SU-2022:1254-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1254-1 advisory. - CVE-2022-24349: Fixed a reflected XSS in the action configuration window bsc1196944. - CVE-2022-24917: Fixed a reflected XSS in t...

REDCap 11.3.9 - Stored Cross Site Scripting Vulnerability

Exploit Title: REDCap 11.3.9 - Stored Cross-Site Scripting Exploit Author: Kendrick Lam References: https://github.com/KCL04/XSS-PoCs/blob/main/CVE-2021-42136.js Vendor Homepage: https://projectredcap.org Software Link: https://projectredcap.org Version: Redcap before 11.4.0 Tested on: 11.2.5 CVE...

The vulnerability of the Git-based software platform’s GraphQL component allows a hacker to influence the integrity of data during collaborative code development on GitLab.

The vulnerability of the GraphQL component of the software platform based on Git for collaborative code development on GitLab is related to the lack of checking for the presence of the X-CSRF-Token header in GET requests. Exploiting this vulnerability allows an attacker to compromise data integri...

CVE-2022-27671

A CSRF token visible in the URL may possibly lead to information disclosure vulnerability...

Information disclosure

A CSRF token visible in the URL may possibly lead to information disclosure vulnerability...

CVE-2022-27671

CVE-2022-27671 affects SAP BusinessObjects Business Intelligence Platform (SAP BI Platform). The vulnerability arises from a CSRF token visible in URLs, which may allow information disclosure. Public references in the CVE describe this cross-site request forgery vector and its potential to expose...

CVE-2022-27671

A CSRF token visible in the URL may possibly lead to information disclosure vulnerability...

Debian DLA-2980-1 : zabbix - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2980 advisory. Several security vulnerabilities have been discovered in zabbix, a network monitoring solution. An authenticated user can create a link with reflected Javascript...

CVE-2021-41245

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by privUITransactionFile aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaround, use the session implementation by adding in the iTop conf...

CVE-2021-41245

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by privUITransactionFile aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaround, use the session implementation by adding in the iTop conf...

CVE-2021-41245

CVE-2021-41245 affects Combodo iTop prior to 2.7.6 and 3.0.0 where CSRF tokens generated by privUITransactionFile are not properly checked. RH and Red Hat entries corroborate the same issue and note that versions 2.7.6 and 3.0.0 include a patch. A workaround is to use a session-based implementati...

Textpattern CMS < 4.8.8 XSS Vulnerability

Textpattern CMS is prone to a cross-site scripting XSS vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2021-44082

textpattern 4.8.7 is vulnerable to Cross Site Scripting XSS via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request...

CVE-2021-44082

textpattern 4.8.7 is vulnerable to Cross Site Scripting XSS via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request...

CVE-2021-44082

textpattern 4.8.7 is vulnerable to Cross Site Scripting XSS via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request...

Cross site scripting

textpattern 4.8.7 is vulnerable to Cross Site Scripting XSS via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request...

CVE-2021-44082

textpattern 4.8.7 is vulnerable to Cross Site Scripting XSS via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request...

CVE-2021-44082

Textpattern CMS 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote, unauthenticated attacker can use this to trigger remote code execution by uploading a webshell after stealing a CSRF token.

GHSA-CR8C-972V-RMP3 pgAdmin 4 Path Traversal vulnerability

When run in server mode, pgAdmin 4 allows users to store files on the server under individual storage directories. Files such as SQL scripts may be uploaded through the user interface. The URI to which upload requests are made fails to validate the upload path to prevent path traversal techniques...