Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to hijack the authentication of a logged in user to force a logout via unspecified vectors...

CVE-2016-7809

The CVE-2016-7809 entry concerns a CSRF vulnerability in Corega CG-WLR300NX firmware versions 1.20 and earlier. Affected product: CG-WLR300NX (wireless router). Vulnerable component: the firmware’s authentication handling allows an attacker to hijack a logged-in user’s session to perform unintend...

CVE-2015-1786

Cross-site request forgery CSRF vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers...

CVE-2017-9517

atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV...

CVE-2017-9518

atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails...

openSUSE Security Update : deluge (openSUSE-2017-656)

This update for deluge fixes two security issues : - CVE-2017-9031: A remote attacker may have used a directory traversal vulnerability in the web interface bsc1039815 - CVE-2017-7178: A remote attacher could have exploited a CSRF vulnerability to trick a logged-in user to perform actions in the...

Subsonic 6.1.1 - Cross-Site Request Forgery Vulnerability

Exploit for windows platform in category web applications + Credits: John Page a.k.a hyp3rlinx Vendor: ================ www.subsonic.org Product: =============== subsonic v6.1.1 Subsonic is a media streaming server. You install it on your own computer where you keep your music or video collection...

Starbucks: CSRF in Report Lost or Stolen Page https://www.starbucks.com/account/card

Hi, When a user registers with an option to get instant digital card, a card will be registered against that users name. There is CSRF in card removal process when user wants to report cards as stolen or lost. There is no CSRF protection on the post requests when...

Fedora 25 : wordpress (2017-d968f5a95f)

WordPress 4.7.5 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.7.4 and earlier are affected by six security issues : - Insufficient redirect validation in the HTTP class. Reported by Ronni...

CVE-2015-3191

CVE-2015-3191 is a CSRF vulnerability in the Cloud Foundry UAA change_email endpoint. Affected are Cloud Foundry cf-release versions prior to v210 and UAA standalone deployments prior to 2.3.0 (specifically UAA 2.2.6 or earlier; cf-release v209 or earlier). The issue allows an attacker to trigger...

CVE-2017-5657

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery CSRF attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active...

CVE-2016-4904

CVE-2016-4904 affects WP-OliveCart and WP-OliveCartPro prior to 3.1.3/3.1.8. The issue is a Cross-site Request Forgery (CSRF) vulnerability that can allow an attacker to hijack a user’s authenticated session to perform unintended operations via unspecified vectors. Affected versions expose users ...

CVE-2017-6634

A vulnerability in the Device Manager web interface of Cisco Industrial Ethernet 1000 Series Switches 1.3 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against a user of an affected system. The vulnerability is due to insufficient CSRF...

CVE-2017-7662

Apache CXF Fediz ships with an OpenId Connect OIDC service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF Cross Style Request Forgery style vulnerability has been found in this web application in Apache CXF Fediz...

Cross site request forgery (csrf)

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4...

CVE-2017-7661

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4...

CVE-2017-8928

mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF...

CVE-2016-5889

IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 115085...

CVE-2017-8875

CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL...

WordPress Clean Login Plugin CSRF Vulnerability

WordPress "Clean Login" is a front-end login and registration plugin. WordPress Clean Login plugin suffers from a CSRF vulnerability, which can be exploited by remote attackers to change wordpress login redirect url to other malicious addresses...