10424 matches found
CVE-2021-30114
Web-School ERP V 5.0 contains a cross-site request forgery CSRF vulnerability that allows a remote attacker to create a voucher payment request through module/accounting/voucher/create. The application fails to validate the CSRF token for a POST request using admin privilege...
UBUNTU-CVE-2021-30147
DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php...
CVE-2021-24172
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the DB, plugins, and current...
CVE-2021-24172
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the DB, plugins, and current...
CVE-2021-29349
Mahara 20.10 is affected by Cross Site Request Forgery CSRF that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieformdeleteallnotifications...
CVE-2021-29349
Mahara 20.10 is affected by Cross Site Request Forgery CSRF that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieformdeleteallnotifications...
PT-2021-14672 · Jenkins · Jenkins Build With Parameters Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Build With Parameters Plugin versions 1.5 and earlier Description: A cross-site request forgery CSRF vulnerability exists, allowing attackers to build a project with attacker-specified parameters. This issue arises because the plugin...
PT-2021-14676 · Jenkins · Jenkins Owasp Dependency-Track Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins OWASP Dependency-Track Plugin versions 3.1.0 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins. The issue arises...
CSRF vulnerability and missing permission check in Team Foundation Server allow capturing credentials
Team Foundation Server 5.157.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...
CVE-2021-26215
SeedDMS 5.1.x is affected by cross-site request forgery CSRF in out.EditDocument.php...
Cross site request forgery (csrf)
SeedDMS 5.1.x is affected by cross-site request forgery CSRF in out.EditDocument.php...
Cross site request forgery (csrf)
SeedDMS 5.1.x is affected by cross-site request forgery CSRF in out.EditFolder.php...
CVE-2021-24133
Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account...
CVE-2021-21627
A cross-site request forgery CSRF vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains...
Apache Tomcat <= 5.5.25 CSRF Vulnerability - Windows
Apache Tomcat is prone to a cross-site request forgery CSRF vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...
Apache Tomcat <= 5.5.25 CSRF Vulnerability - Linux
Apache Tomcat is prone to a cross-site request forgery CSRF vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...
CSRF in the SetFeatureEnabled.jspa resource - CVE-2021-26071
The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery CS...
VestaCP 0.9.8 - File Upload CSRF
Exploit Title: VestaCP 0.9.8 - File Upload CSRF Exploit Author: Fady Othman Date: 16-03-2021 Vendor Homepage: https://vestacp.com/ Software Link: https://github.com/myvesta/vesta Version: Vesta Control Panel aka VestaCP through 0.9.8-27 and myVesta through 0.9.8-26-39 CVE ID: CVE-2021-28379 Patch...
CVE-2020-24983
An issue was discovered in Quadbase EspressReports ES 7 Update 9. An unauthenticated attacker can create a malicious HTML file that houses a POST request made to the DashboardBuilder within the target web application. This request will utilise the target admin session and perform the authenticate...