PT-2022-27952 · Jenkins · Jenkins Sonar Gerrit Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Sonar Gerrit Plugin versions 377.v8f3808963dc5 and earlier Description: A cross-site request forgery CSRF issue allows attackers to have Jenkins connect to Gerrit servers using attacker-specified credentials IDs, potentially capturing...

Cross site request forgery (csrf)

daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting XSS and cross site request forgery CSRF vulnerability which leads to account takeover in the mng-del.php file because of an unescaped variable reflected in...

CVE-2022-3926

The WP OAuth Server OAuth Authentication WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID...

CVE-2022-3677 Advanced Import < 1.3.8 - Arbitrary Plugin Installation & Activation via CSRF

The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and activate arbitrary ones from the blog via CSRF attacks...

CVE-2022-45824

Cross-Site Request Forgery CSRF vulnerability in Advanced Booking Calendar plugin = 1.7.1 on WordPress...

CVE-2022-45824

Cross-Site Request Forgery CSRF vulnerability in Advanced Booking Calendar plugin = 1.7.1 on WordPress...

CVE-2022-43470

Cross-site request forgery CSRF vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and earlier, +F FS030W software versions v3.3.5 and earlier, and +F FS040W software versions v1.4.1 and earlier allows an adjacent attacker to hijack the...

CVE-2022-35730

Cross-Site Request Forgery CSRF vulnerability in Oceanwp sticky header plugin = 1.0.8 on WordPress...

CVE-2022-35730 WordPress Oceanwp sticky header plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Oceanwp sticky header plugin = 1.0.8 on WordPress...

CVE-2022-4218

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the listquizzes function. This makes it possible for unauthenticated attackers to delete quizzes and copy quizzes via a forged...

CVE-2022-45674

Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery CSRF via function fromSysToolReboot...

Cross site request forgery (csrf)

Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery CSRF via function fromSysToolRestoreSet...

CVE-2022-45667

Tenda i22 V1.0.0.34687 is vulnerable to Cross Site Request Forgery CSRF via function fromSysToolRestoreSet...

CVE-2022-40489

ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery CSRF vulnerability that allows a Super Administrator user to be injected into administrative users...

CVE-2022-40489

ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery CSRF vulnerability that allows a Super Administrator user to be injected into administrative users...

CVE-2022-40489

CVE-2022-40489 affects ThinkCMF v6.0.7 and represents a Cross-Site Request Forgery (CSRF) vulnerability that can let a Super Administrator be injected into administrative users. The core issue is CSRF in ThinkCMF, enabling credential injection and site takeover as described in multiple sources (R...

CVE-2022-3747 Becustom <= 1.0.5.2 - Cross-Site Request Forgery

The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validation when saving the plugin's settings. This makes it possible for unauthenticated attackers to update the plugin's settings like...

CVE-2022-44937

Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery CSRF via the Add function under the Administrator List module...

CVE-2022-3850 Find and Replace All <= 1.3 - Arbitrary Replacement via CSRF

The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack...

CVE-2022-23044

CVE-2022-23044 affects Tiny File Manager 2.4.8 and is caused by a CSRF vulnerability that allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application. The initial description confirms CSRF as the root cause and unauthenticated access, with prac...