10419 matches found
CVE-2023-47677
Realtek rtl819x Jungle SDK v3.4.11 contains a CSRF vulnerability in its Boa web server (used by LevelOne WBR-6013). TALOS reports a cross-site request forgery that can be triggered by a specially crafted network packet, potentially causing state-changing actions on an authenticated device. Affect...
CVE-2024-5616
CVE-2024-5616 affects mudler/LocalAI up to version 2.15.0, where the model deletion functionality is vulnerable to CSRF due to insufficient protection. An attacker could lure a user to delete an installed model (e.g., gpt-4-vision-preview) by visiting a malicious page. Affected component: model d...
CVE-2024-40603
CVE-2024-40603 affects the MediaWiki ArticleRatings extension up to 1.42.1. The vulnerability is in Special:ChangeRating, where CSRF can alter data via a GET request. Underlying cause: CSRF weakness in the GET-based operation. Impact: data modification is possible, with CVSS 3.1 base score 4.3 (M...
PT-2024-36727 · Mudler · Localai
Name of the Vulnerable Software and Affected Versions: mudler/LocalAI versions up to and including 2.15.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists, allowing attackers to trick victims into deleting installed models by crafting a malicious HTML page. This can cause the...
CVE-2024-39020
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/vpsApiDatadeal.php?mudi=rev&nohrefStr=close...
CVE-2024-39021
CVE-2024-39021 affects idccms v1.35, with a Cross-Site Request Forgery (CSRF) vulnerability in the component /admin/vpsApiData_deal.php?mudi=del. The available documents attribute the issue to that specific endpoint/action, but do not provide a patch version, workaround, exploit details, or mitig...
CVE-2024-39020
idccms v1.35 is affected by a CSRF vulnerability exploitable through /admin/vpsApiData_deal.php?mudi=rev&nohrefStr=close. The issue, described across multiple sources, involves unauthorized actions via a crafted request. The connected PT-PTSecurity advisory notes a temporary workaround to disable...
CVE-2024-39019
CVE-2024-39019 affects idccms v1.35, exposing a Cross-Site Request Forgery (CSRF) via the endpoint /admin/idcProData_deal.php?mudi=del . The Red Hat/CNNVD/CVE sources corroborate CSRF in idccms 1.35 and highlight the vulnerable parameter combination (mudi=del) that enables unauthorized actions. N...
CVE-2024-39023
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via admin/infodeal.php?mudi=add&nohrefStr=close...
PT-2024-28331 · Idccms · Idccms
Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in idccms via the "/admin/vpsApiData deal.php" endpoint, specifically when the mudi and nohrefStr parameters are set to 'rev' and 'close', respectively...
CVE-2024-5887
CVE-2024-5887 entry is rejected/not used and does not represent an active vulnerability.
WordPress Himer theme < 2.1.1 - Multiple CSRF vulnerability
Multiple CSRF vulnerability discovered by Sushmita Poudel in WordPress Theme Himer versions 2.1.1...
CVE-2024-2376
The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
CVE-2024-2235
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack...
CVE-2024-2235
The CVE-2024-2235 entry concerns the Himer WordPress theme pre-2.1.1 lacking CSRF checks in multiple areas, enabling CSRF-based vote manipulation on polls (including restricted ones). Affected product: Himer WordPress theme
CVE-2024-39326 SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a Skill
SkillTree is a micro-learning gamification platform. Prior to version 2.12.6, the endpoint /admin/projects/projectname/skills/skillname/video and probably others is open to a cross-site request forgery CSRF vulnerability. Due to the endpoint being CSRFable e.g POST request, supports a content typ...
CVE-2024-39119
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via admin/infodeal.php?mudi=rev&nohrefStr=close...
CVE-2024-39119
CVE-2024-39119 affects idccms v1.35, where a Cross‑Site Request Forgery (CSRF) is possible via admin/info_deal.php?mudi=rev&nohrefStr=close. The root cause is that requests from trusted users are not adequately verified, enabling an attacker to trick a victim into performing a sensitive operation...
PT-2024-37134 · WordPress · Sitetweet
Name of the Vulnerable Software and Affected Versions: sitetweet WordPress plugin versions 0.2 and earlier Description: The issue concerns a lack of CSRF check in some areas of the plugin, along with missing sanitization and escaping. This could allow attackers to make logged-in admins add Stored...