10423 matches found
Modula < 2.6.91 - Unauthenticated Troubleshooting Settings Update
The plugin does not have authorisation and CSRF checks when updating its troubleshooting settings, which could allow any unauthenticated user to update them...
CVE-2022-2762 AdminPad < 2.2 - Note Update via CSRF
The AdminPad WordPress plugin before 2.2 does not have CSRF check when updating admin's note, allowing attackers to make a logged in admin update their notes via a CSRF attack...
PT-2022-18525 · WordPress · Adminpad
Name of the Vulnerable Software and Affected Versions: AdminPad WordPress plugin versions prior to 2.2 Description: The issue concerns a lack of CSRF check when updating an admin's note, allowing attackers to make a logged-in admin update their notes via a CSRF attack. Recommendations: For versio...
FreeBSD : phpmyfaq -- CSRF vulnerability (c253c4aa-5126-11ed-8a21-589cfc0f81b0)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c253c4aa-5126-11ed-8a21-589cfc0f81b0 advisory. - phpmyfaq developers report: phpMyFAQ does not implement sufficient checks to avoid CSRF when logging...
PT-2022-26307 · Unknown · Simple Exam Reviewer Management System
Name of the Vulnerable Software and Affected Versions: Simple Exam Reviewer Management System version 1.0 Description: The issue concerns a Cross Site Request Forgery CSRF vulnerability via the Exam List. This means an attacker could potentially trick a user into performing unintended actions on...
Jenkins Katalon Plugin 跨站请求伪造漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A cross-site request...
reSmush.it Image Optimizer < 0.4.7 - Multiple CSRF
The plugin does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site. PoC...
CVE-2022-43418
A cross-site request forgery CSRF vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...
PT-2022-26903 · Jenkins · Jenkins Katalon Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Katalon Plugin versions 1.0.33 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method,...
Nextcloud: CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link
Summary It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link. e.g. in an email, chat link, etc This vulnerability was introduced in an attempt to fix 1720043. The patch however can be bypassed and also introduced a CSRF vulnerability...
CVE-2022-3151
The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when deleting cursors, which could allow attackers to made a logged in admin delete arbitrary cursors via a CSRF attack...
CVE-2022-3082
The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...
CVE-2022-3151 WP Custom Cursors < 3.0.1 - Arbitrary Cursor Deletion via CSRF
The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when deleting cursors, which could allow attackers to made a logged in admin delete arbitrary cursors via a CSRF attack...
PT-2022-20759 · WordPress · Wp Custom Cursors
Name of the Vulnerable Software and Affected Versions: WP Custom Cursors WordPress plugin versions prior to 3.0.1 Description: The issue is related to the lack of a CSRF check when creating and editing cursors, which could allow attackers to perform actions via CSRF attacks on logged-in admins...
PT-2022-20334 · Miniorange · Miniorange Discord Integration Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: miniOrange Discord Integration WordPress plugin versions prior to 2.1.6 Description: The issue concerns a lack of authorization and CSRF protection in certain AJAX actions of the plugin, allowing any logged-in user, such as a subscriber, to...
Cross site request forgery (csrf)
WAYOS LQ09 22.03.17V was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to send crafted requests to the server from the affected device. This vulnerability is exploitable due to a lack of authentication in the component Usbupload.htm...
Cross site request forgery (csrf)
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add an administrator account...
CVE-2022-41136
Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS in Vladimir Anokhin's Shortcodes Ultimate plugin = 5.12.0 on WordPress...
