10425 matches found
Auth0-js bypasses CSRF checks
The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it's missing from the authorization response, leaving the client vulnerable to CSRF attacks...
tuugo.in Cross Site Request Forgery vulnerability
Open Bug Bounty ID: OBB-575904 Description| Value ---|--- Affected Website:| tuugo.in Vulnerable Application:| hidden until disclosure Vulnerability Type:| CSRF Cross-Site Request Forgery / CWE-352 CVSSv3 Score:| hidden until disclosure Disclosure Standard:| Coordinated Disclosure based on ISO...
Fedora 26 : bugzilla (2018-b79f325c48)
A CSRF vulnerability in Bugzilla's report.cgi would allow a third-party site to extract confidential information from a bug the victim had access to. This security bug has been published as CVE-2018-5123. This updates contains Bugzilla 5.0.4, which fixes the issue. Note that Tenable Network...
CVE-2018-7733
An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/addpost.html...
Cross site request forgery (csrf)
An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/addpost.html...
Design/Logic Flaw
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter...
Bravo Tejari Web Portal - Cross-Site Request Forgery Vulnerability
Exploit for multiple platform in category web applications Exploit Title: Bravo Tejari Web Portal-CSRF CVE-ID: CVE-2018-7216 Vulnerability Type: Cross Site Request Forgery CSRF Vendor of Product: Tejari Affected Product Code Base: Bravo Solution Affected Component: Web Interface Management. Attac...
CVE-2018-7590
CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation...
CVE-2018-7590
CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation...
CVE-2018-7590
CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation...
CVE-2018-0520
CVE-2018-0520 is a CSRF vulnerability in Fuji Electric FS010W firmware in FS010W_00_V1.3.0 and earlier that could allow an attacker to hijack administrator authentication via unspecified vectors. The FS010W WiFi router is affected; root cause is CSRF in the device’s web management interface. Reme...
CVE-2018-0146
A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to improper CSRF protection by the affected application. An attacker could...
CVE-2018-7308
A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modify any files in any hosting account...
Cross site request forgery (csrf)
MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts...
CVE-2016-0348
Cross-site request forgery CSRF vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. IBM X-Force ID: 111813...
CVE-2016-0348
IBM TRIRIGA Application Platform is affected by a CSRF vulnerability (CVE-2016-0348) in versions 3.3, 3.3.1, 3.3.2 and 3.4, due to improper validation of user input that enables unauthorized actions via forged requests. IBM’s Security Bulletin lists fixes in 3.5.0.1, 3.4.2.3, and 3.3.2.6 fix pack...
CVE-2017-12415
OXID eShop Community Edition before 6.0.0 RC2 development, 4.10.x before 4.10.5 maintenance, and 4.9.x before 4.9.10 legacy, Enterprise Edition before 6.0.0 RC2 development, 5.2.x before 5.2.10 legacy, and 5.3.x before 5.3.5 maintenance, and Professional Edition before 6.0.0 RC2 development, 4.9....
CVE-2018-6940
A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF...
Cross site request forgery (csrf)
An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account...