CVE-2021-31677

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can modify admin and other members' passwords...

Design/Logic Flaw

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can modify admin and other members' passwords...

Cross site request forgery (csrf)

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that allows attackers to delete admin and other members' account numbers...

Design/Logic Flaw

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can delete import information about a user's company...

CVE-2021-31678

CVE-2021-31678 describes a CSRF vulnerability in PESCMS-V2.3.3 that can delete a user’s company import information. Multiple connected sources (NVD, Red Hat, CNVD, OSV, CNVD etc.) corroborate the impact on PESCMS-V2.3.3. The records do not provide a patch version or remediation steps within the d...

CVE-2021-31679

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that allows attackers to delete admin and other members' account numbers...

CVE-2021-23163

JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF Cross-Site Request Forgery for specific endpoints. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.33.6 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6...

U.S. Dept Of Defense: CSRF to ATO at https://█████/user/account [HtUS]

hello dod security team today while i was doing pentest on your scope i came across https://████████/user/account so i register and after that tried to edit my data and the data was in json request so i simple change content-type to content-type application/x-www-form-urlencoded and the data was...

CVE-2022-1967

The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it coul...

GHSA-QQ85-8G89-R5RC Cross-Site Request Forgery in Jenkins Request Rename Or Delete Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, thereby renaming or deleting jobs...

GHSA-3Q7F-W8FR-368V Cross-Site Request Forgery in Jenkins XPath Configuration Viewer Plugin

A cross-site request forgery CSRF vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions...

Cross-Site Request Forgery in Jenkins Failed Job Deactivator Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs. This CSRF vulnerability is only exploitable in Jenkins 2.286 and earlier, LTS 2.277.1 and earlier. See the LTS upgrade guide...

CVE-2022-34797

A cross-site request forgery CSRF vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials...

CVE-2022-34780

A cross-site request forgery CSRF vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials...

CVE-2022-34817

CVE-2022-34817 describes a CSRF vulnerability in the Jenkins Failed Job Deactivator Plugin, affecting version 1.2.1 and earlier. The vulnerability allows an attacker to disable jobs in Jenkins via a crafted request. The issue is noted across multiple sources (NVD entry for CVE-2022-34817 and PT S...

CVE-2022-29495

Cross-Site Request Forgery CSRF vulnerability in Sygnoos Popup Builder plugin = 4.1.11 at WordPress allows an attacker to update plugin settings...

PT-2022-22369 · Jenkins · Jenkins Failed Job Deactivator Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Failed Job Deactivator Plugin versions 1.2.1 and earlier Jenkins versions 2.286 and earlier Jenkins LTS versions 2.277.1 and earlier Description: A cross-site request forgery CSRF issue allows attackers to disable jobs. This issue is...

PT-2022-22349 · Jenkins · Jenkins Deployment Dashboard Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Deployment Dashboard Plugin versions 1.0.10 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials. Recommendations: For...

PT-2022-22370 · Jenkins · Jenkins Failed Job Deactivator Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Failed Job Deactivator Plugin versions 1.2.1 and earlier Description: The issue concerns a lack of permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs. Additionally, t...