10424 matches found
Cross site request forgery (csrf)
save-server npm package before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation Tokens etc.. The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
CVE-2020-15135 CSRF vulnerability in save-server
save-server npm package before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation Tokens etc.. The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
Moderate: Red Hat Security Advisory: AMQ Online 1.5.2 release and security update
An update of the Red Hat OpenShift Container Platform 3.11 and 4.4/4.5 container images is now available for Red Hat AMQ Online. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...
Joomla 2.5.x < 3.9.20 Multiple Vulnerabilities (5814-joomla-3-9-20)
According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.20. It is, therefore, affected by multiple vulnerabilities. - A missing token check in the ajaxinstall endpoint cominstaller causes a CSRF vulnerability. 20200701 - Missing...
CVE-2020-15700
An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajaxinstall endpoint of cominstaller causes a CSRF vulnerability...
CVE-2020-15700
An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajaxinstall endpoint of cominstaller causes a CSRF vulnerability...
CVE-2020-15695
CVE-2020-15695 affects Joomla! up to version 3.9.19. The issue is a missing token check in the remove request section of the com_privacy component, causing a CSRF vulnerability. The CVSS details indicate network access, no privileges required, user interaction required, and low impact across conf...
PT-2020-14590 · Open Source Matters · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.9.19 and earlier Description: A missing token check in the remove request section of com privacy causes a CSRF issue. Recommendations: For versions 3.9.19 and earlier, update to a version that includes the fix for the missi...
PT-2020-15417 · Jenkins · Jenkins Fortify On Demand Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Fortify on Demand Plugin versions 5.0.1 and earlier Description: A cross-site request forgery issue allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. This issue...
CakePHP Cross-Site Request Forgery Vulnerability
CakePHP is the United States Cake Software Foundation of a MVC-based architecture , open source Web development framework. The framework has a flexible view caching , automatic generation of CRUD code and other features . A security vulnerability exists in CakePHP versions prior to 4.0.6, which...
Cross site request forgery (csrf)
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery CSRF vulnerability. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2...
CVE-2020-13155
clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...
CVE-2020-13155
clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...
CVE-2020-13426
CVE-2020-13426 affects WordPress with the Multi Scheduler plugin v1.0.0. The vulnerability is a Cross‑Site Request Forgery in the plugin’s forms, allowing an attacker to delete records (users) when a target ID is known. The root cause is CSRF protection failure in the plugin’s request handling. P...
WP-Pro-Quiz <= 0.37 - CSRF Leading to Arbitrary Quiz Deletion
Abusing this Cross-Site Request Forgery CSRF issue, an unauthenticated attacker could make a logged in admin delete any quiz on vulnerable website. The PoC will be displayed once the issue has been remediated...
Mattermost Server Cross-Site Request Forgery Vulnerability (CNVD-2020-35367)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A cross-site request forgery vulnerability exists in Mattermost Server, which stems from a WEB application that does not adequately validate whether a request is coming from a trusted user, and can ...
DEBIAN-CVE-2020-8167
A CSRF vulnerability exists in rails = 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains...
CVE-2020-8167
A CSRF vulnerability exists in rails = 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains...
