10423 matches found
Debian DSA-5442-1 : flask - security update
The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5442 advisory. It was discovered that in some conditions the Flask web framework may disclose a session cookie. For the oldstable distribution bullseye, this problem has been fixed in...
CVE-2023-34839
A Cross Site Request Forgery CSRF vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom CSRF exploit to create new user function in the application...
CVE-2023-2628
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks either flawed or missing completely in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary...
CVE-2023-2627
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings...
CVE-2020-18418
A Cross site request forgery CSRF vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.php?s=Admin-Admin-Insert...
Quiz Expert – Easy Quiz Maker, Exam and Test Manager <= 1.5.0 - Cross-Site Request Forgery
The plugin does not adequately verify requests, leading to a Cross-Site Request Forgery CSRF vulnerability...
PT-2023-18882 · WordPress · Gsheetconnector-Gravityforms-Pro +1
Name of the Vulnerable Software and Affected Versions: Gravity Forms Google Sheet Connector WordPress plugin versions prior to 1.3.5 gsheetconnector-gravityforms-pro WordPress plugin versions prior to 1.3.5 Description: The issue concerns a lack of CSRF check when updating the Access Code,...
Jymusic 跨站请求伪造漏洞
Jymusic is a dtorp06 open source application. A security vulnerability exists in Jymusic version v2.0.0. An attacker exploited the vulnerability to execute arbitrary code via /admin.php?s=/addons/config.html&id=6 and modify payment information...
CVE-2023-36345
A Cross-Site Request Forgery CSRF in POS Codekop v2.0 allows attackers to escalate privileges...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.10.62 security update
Red Hat OpenShift Container Platform release 4.10.62 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whi...
jenkins-2-plugin: email-ext: CSRF vulnerability in Email Extension Plugin
A flaw was found in the Jenkins Email Extension Plugin. Affected versions of the Jenkins Email Extension Plugin are vulnerable to cross-site request forgery caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker...
PT-2023-25542 · Unknown · Pos Codekop
Name of the Vulnerable Software and Affected Versions: POS Codekop version 2.0 Description: A Cross-Site Request Forgery CSRF issue allows attackers to escalate privileges. Recommendations: For POS Codekop version 2.0, consider implementing proper CSRF token validation to prevent unauthorized...
PT-2023-19210 · WordPress · Muneeb Form Builder
Name of the Vulnerable Software and Affected Versions: Muneeb Form Builder plugin versions = 1.9.9.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web application...
CVE-2022-3372
There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel,...
CVE-2020-20502
Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function...
CVE-2023-3320
The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce validation in the /admin/views/admin.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and injec...
PT-2023-11561 · Gila · Gila Cms
Name of the Vulnerable Software and Affected Versions: Gila GilaCMS version 1.11.4 Description: The issue allows a remote attacker to execute arbitrary code via the cm/update rows/user parameter. This is a Cross Site Request Forgery vulnerability. Recommendations: For Gila GilaCMS version 1.11.4,...
WordPress Complianz Premium Plugin <= 6.4.6.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software Complianz Premium Type Plugin Vulnerable versions = 6.4.6.1 Fixed in 6.4.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-33333 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID d6646d9333a1 Credits Rafie Muhammad...
