Jenkins Folders Plugin cross-site request forgery vulnerability

Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to copy an item, which could potentially automatically approve unsandboxed scripts and allo...

PT-2023-27394 · Jenkins · Jenkins Folders Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Folders Plugin versions 6.846.v23698686f0f6 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to copy folders, potentially leading to the automatic approval of unsandboxed scripts and the...

CSRF vulnerability in cloudbees-folder

cloudbees-folder 6.846.v23698686f0f6 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to copy a view inside a folder. cloudbees-folder 6.848.ve3bfd7839a81 requires POST requests for t...

The vulnerability of the saveParentControlInfo() function in Tenda AC8 router software allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the saveParentControlInfo function in the Tenda AC8 router’s microprogramming software is related to the issue of the operation going beyond the buffer in memory when processing the deviceId parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrar...

Jenkins plugins Multiple Vulnerabilities (2023-03-21)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Medium Permissions in Jenkins can be enabled and disabled. Some permissions are disabled by default, e.g., Overall/Manage or Item/Extended...

CVE-2022-43712

POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965...

Design/Logic Flaw

POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965...

PT-2023-14300 · Gx · Xperiencentral

Name of the Vulnerable Software and Affected Versions: GX Software XperienCentral versions 10.36.0 and earlier Description: The issue allows unauthorized users to post data to the server by sending POST requests to the /web/mvc endpoint if they can bypass other security filters. Recommendations:...

CVE-2022-43712

POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965...

CVE-2022-43712

POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965...

CSRF vulnerability and missing permission check in servicenow-devops allow capturing credentials

servicenow-devops 1.38.0 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

GHSA-WGVX-9RH5-4G4M Jenkins Benchmark Evaluator Plugin vulnerable to cross-site request forgery

Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the...

CVE-2023-37277

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The REST API allows executing all actions via POST requests and accepts text/plain, multipart/form-data or application/www-form-urlencoded as content types which can be sent via regular HTML...

CVE-2021-42079

An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. POC Step 1: Prepare the SSRF with a request like this: GET...

Server side request forgery (ssrf)

An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests...

CVE-2021-42079 SSRF vulnerability in OSNEXUS QuantaStor before 6.0.0.355

An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. POC Step 1: Prepare the SSRF with a request like this: GET...

CVE-2021-42079 SSRF vulnerability in OSNEXUS QuantaStor before 6.0.0.355

An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. POC Step 1: Prepare the SSRF with a request like this: GET...

CVE-2021-42079

CVE-2021-42079 affects OSNEXUS QuantaStor prior to 6.0.0.355. An authenticated administrator can craft an alert via POST to alertConfigSet and trigger alertRaise, enabling a server-side request forgery (SSRF) through the QuantaStor alerting workflow. The POC shows constructing an alert with vario...

PT-2023-12394 · Osnexus · Quantastor

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned Description: The issue allows an authenticated administrator to craft an alert that can execute a Server-Side Request Forgery SSRF attack, but only with POST requests. Recommendations: At the moment,...

PiiGAB M-Bus 跨站请求伪造漏洞

PiiGAB M-Bus is a communication protocol used between meters and centralized data collection systems or prepaid units from PiiGAB. A cross-site request forgery vulnerability exists in PiiGAB M-Bus version 900S, which stems from susceptibility to cross-site request forgery attacks and can be...