GHSA-RQ77-P4H8-4CRW gorilla/csrf CSRF vulnerability due to broken Referer validation

Summary gorilla/csrf is vulnerable to CSRF via form submission from origins that share a top level domain with the target origin. Details gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it...

Open Redirect

Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to Open Redirect due to insufficient validation of the Referer header and wphttpreferer request parameter when a user accesses a link with an expired or...

DEBIAN-CVE-2019-17675

WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF...

UBUNTU-CVE-2019-17675

WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF...

CVE-2019-17675: Cross-Site Request Forgery (CSRF)

WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF...

PT-2019-5221 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.4 Description: The issue is related to a type confusion error during referer validation on admin pages, which could lead to a CSRF attack. This might allow a remote attacker to access confidential data,...

TP-Link TL-WRN841N Cross-Site Request Forgery Vulnerability

The TP-Link TL-WRN841N is a wireless router product from China P&L TP-LINK. A cross-site request forgery vulnerability exists in the web interface of the TP-Link TL-WRN841N version 0.9.1 4.16 v0348.0, which stems from the program failing to adequately validate the referer field. A remote attacker...

CVE-2018-15702

The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field...

YXcmsApp V1.4.3 'uninstall()' Function Has Cross-Site Request Forgery Vulnerability

Yxcms is an enterprise building system based on PHP and mysql technology. A cross-site request forgery vulnerability exists in the YXcmsApp V1.4.3 'uninstall' function. Due to the lack of HTTP Referer or token validation, an attacker can exploit the vulnerability to uninstall the system's...

phpyun csrf修改用户密码

简要描述： phpyun csrf修改用户密码 详细说明： 更新用户信息的请求没有防御csrf。可以修改用户的邮箱。而重置密码功能是选择用户信息中的邮箱发送找回验证码。结合利用。 修改用户信息的请求为:...

Destoon全版本通杀SQL注入2

简要描述： 要过年了，加班加点的。个人觉得不应该仅仅只检测用户的输入，而应该在SQL查询前进行检测才能更好的起到防注入的效果吧，因为人总是有遗漏的。 详细说明： common.inc.php 0x00 if!empty$SERVER'REQUESTURI' stripuri$SERVER'REQUESTURI';//跟进0x01 if$POST $POST = stripsql$POST; stripkey$POST; if$GET $GET = stripsql$GET; stripkey$GET; ... if$POST extract$POST, EXTRSKIP; if$GET...

SuSE Update for flash-player SUSE-SA:2007:046

Check for the Version of flash-player OpenVAS Vulnerability Test $Id: gbsuse2007046.nasl 8050 2017-12-08 09:34:29Z santu $ SuSE Update for flash-player SUSE-SA:2007:046 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is fr...

Cross site request forgery (csrf)

Adobe Flash Player 8.0.34.0 and earlier insufficiently validates HTTP Referer headers, which might allow remote attackers to conduct a CSRF attack via a crafted SWF file...