com.github.hiwepy:shiro-biz (>=1.1.0.release, <=1.1.2.release), com.github.hiwepy:shiro-csrfguard-spring-boot-starter (>=1.0.0.release, <=1.0.1.release) +41 more potentially affected by CVE-2026-23901 via org.apache.shiro:shiro-core (1.5.0)

org.apache.shiro:shiro-core MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.github.hiwepy:shiro-biz =1.1.0.release, =1.0.0.release, =1.0.0, =1.0.0, =1.3.1, =1.0.0, =1.4.0 -...

CVE-2021-28490

In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token...

EUVD-2022-4458

Malicious code in bioql PyPI...

edu.internet2.middleware.grouper:grouper-ui (>=2.4.0, <=2.6.13), edu.internet2.middleware.grouper:grouper-ui-webapp (>=2.6.10, <=2.6.13) potentially affected by CVE-2021-28490 via org.owasp:csrfguard (3.1.0)

org.owasp:csrfguard MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.owasp:csrfguard and may be impacted: - edu.internet2.middleware.grouper:grouper-ui =2.4.0, =2.6.10, =2.6.13 Source cves: CVE-2021-28490 Source advisory:...

Cross-Site Request Forgery in OWASP CSRFGuard

In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token...

com.jalalkiswani:jk-faces (>=0.0.1, <=0.0.9-4), com.jalalkiswani:jk-web (>=0.0.3, <=0.0.9-2) +4 more potentially affected by CVE-2021-28490 via org.owasp:csrfguard (3.0.0)

org.owasp:csrfguard MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.owasp:csrfguard and may be impacted: - com.jalalkiswani:jk-faces =0.0.1, =0.0.3, =0.0.9, =0.0.7, =2.9.0-01, =2.16.0-01 Source cves: CVE-2021-28490 Source...

CVE-2021-28490

In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token...

CVE-2021-28490

In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token...

Cross site request forgery (csrf)

In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token...

CVE-2021-28490

In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token...

CVE-2021-28490

In OWASP CSRFGuard (through 3.1.0), a CSRF vulnerability exists where the CSRF cookie can be retrieved using only a session token. This results from the cookie handling logic enabling CSRF token exposure via a session token, enabling CSRF attacks under network conditions with no authentication re...

com.jalalkiswani:jk-faces (>=0.0.1, <=0.0.9-4), com.jalalkiswani:jk-web (>=0.0.3, <=0.0.9-2) +5 more potentially affected by CVE-2021-28490 via org.owasp:csrfguard (>=3.0.0, <=3.1.0)

org.owasp:csrfguard MAVEN version =3.0.0, =0.0.1, =0.0.3, =0.0.9, =0.0.7, =2.3.0, =2.6.10, =2.9.0-01, =2.16.0-01 Source cves: CVE-2021-28490 Source advisory: MEND:CVE-2021-28490...

CVE-2021-28490

In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token...

PT-2021-17867

Name of the Vulnerable Software and Affected Versions: OWASP CSRFGuard versions 3.1.0 and earlier Description: The issue allows for CSRF to occur because the CSRF cookie may be retrieved by using only a session token. Recommendations: For OWASP CSRFGuard versions 3.1.0 and earlier, at the moment,...

CVE-2021-28490: Cross-Site Request Forgery (CSRF)

In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token...

Owasp CSRFGuard Cross-Site Request Forgery Vulnerability

Owasp CSRFGuard is a library from the OWASP Owasp Foundation in the United States that implements a variant of the Synchronizer Token Mode to mitigate the risk of cross-site request forgery CSRF attacks. A cross-site request forgery CSRF vulnerability exists in OWASP CSRFGuard 3.1.0 and earlier...