Paypal Inc - Broken Authorization & CSRF Vulnerability

Document Title: =============== Paypal Inc - Broken Authorization & CSRF Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2181 Video: https://www.youtube.com/watch?v=52meFKU2Lqg Release Date: ============= 2019-02-08 Vulnerability Laboratory ID VL-ID:...

CVE-2019-7569

An issue was discovered in DOYO aka doyocms 2.320140425 update. There is a CSRF vulnerability that can add a super administrator account via admin.php?c=aadminuser&a=add&run=1...

CVE-2019-7569

An issue was discovered in DOYO aka doyocms 2.320140425 update. There is a CSRF vulnerability that can add a super administrator account via admin.php?c=aadminuser&a=add&run=1...

CVE-2019-1000022

Taoensso Sente version Prior to version 1.14.0 contains a Cross Site Request Forgery CSRF vulnerability in WebSocket handshake endpoint that can result in CSRF attack, possible leak of anti-CSRF token. This attack appears to be exploitable via malicious request against WebSocket handshake endpoin...

Cross site request forgery (csrf)

MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery CSRF vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvgsave that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be...

CVE-2019-1000003

MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery CSRF vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvgsave that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be...

CVE-2019-3604

CVE-2019-3604 is a Cross-Site Request Forgery vulnerability in McAfee ePO (legacy) Cloud. The connected documents describe that unauthenticated users could perform unintended ePO actions by leveraging an authenticated user’s session, via unspecified vectors. The exact vulnerable component/version...

Rockstar Games: CSRF Vulnerability on post creation page /community/create-post.json

In this report the researcher demonstrated how to exploit a CSRF vulnerability on the impacted endpoint. This would allow a remote attacker to spam the community boards as other users. This attack only worked in Chrome browsers. A recent update to Chrome changed how cross-origin requests are...

CVE-2019-6779

CVE-2019-6779 affects CSCMS 4.1.8. The vulnerability is a CSRF flaw on the admin.php/links/save endpoint, enabling an attacker to add, modify, or delete friend links without providing proper authorization. Root cause stated is lack of CSRF protection on that admin action; exploitation details are...

Cross site request forgery (csrf)

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF...

PYSEC-2019-148

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow...

CVE-2017-17835

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow...

CVE-2017-17835

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow...

Command injection

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow...

CVE-2017-17835

CVE-2017-17835 affects Apache Airflow 1.8.2 and earlier. The vulnerability is described as a CSRF flaw that allowed remote command injection on a default Airflow install. The connected documents corroborate the CSRF/vector and the potential for command execution, but do not provide exploitation d...

Cross site request forgery (csrf)

An issue was discovered in creditease-sec insight through 2018-09-11. userdelete in srcpm/app/admin/views.py allows CSRF...

Cross site request forgery (csrf)

An issue was discovered in creditease-sec insight through 2018-09-11. departdelete in srcpm/app/admin/views.py allows CSRF...

CVE-2018-20728

A cross site request forgery CSRF vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php...

Hucart CMS 5.7.4 Cross Site Request Forgery

function posturl,fields var p = document.createElement"form"; p.action = url; p.innerHTML = fields; p.target = "self"; p.method = "post"; document.body.appendChildp; p.submit; function csrfhack var fields; fields += ""; fields += ""; fields += ""; fields += ""; fields += ""; fields += ""; fields ...

Hucart CMS 5.7.4 - Cross-Site Request Forgery (Add Administrator Account)

function posturl,fields var p = document.createElement"form"; p.action = url; p.innerHTML = fields; p.target = "self"; p.method = "post"; document.body.appendChildp; p.submit; function csrfhack var fields; fields += ""; fields += ""; fields += ""; fields += ""; fields += ""; fields += ""; fields ...