Siemens SICAM P850/P855 Authentication Bypass Information Disclosure

The vulnerability of Siemens SICAM P850 and Siemens SICAM P855 multifunctional measuring devices lies in the lack of authentication for critical functions. Exploiting this vulnerability can allow an attacker to disclose internal configuration details of the web interface or modify network setting...

CVE-2022-30337

Cross-Site Request Forgery CSRF vulnerability in JoomUnited WP Meta SEO plugin = 4.4.8 at WordPress allows an attacker to update the social settings...

PT-2022-14146

Name of the Vulnerable Software and Affected Versions PDF24 Article To PDF WordPress plugin versions 4.2.2 and earlier Description The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This cou...

CVE-2021-20662

Missing authentication for critical function in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to alter the setting information without the access privileges via unspecified vectors...

CVE-2021-20636

Cross-site request forgery CSRF vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted...

CVE-2020-12506

Improper Authentication vulnerability in WAGO 750-8XX series with FW version = FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362, WAGO 750-363, WAGO 750-823, WAGO 750-832/xxx-xxx, WAGO...

Cross-site Request Forgery Vulnerability in RICOH printers

Overview Multiple RICOH printers contain Cross-site Request Forgery CWE-352. RICOH COMPANY, LTD. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and RICOH COMPANY, LTD. coordinated under the Information Security Early Warning Partnership. Impact If a user...

Pricing Table by Supsystic < 1.8.1 - Cross-Site Request Forgery to XSS and Setting Changes

CSRF can be exploited against any of the functionalities in the Pricing Table by Supsystic WordPress plugin in vulnerable versions. PoC One example:...

Pricing Table by Supsystic < 1.8.1 - Cross-Site Request Forgery to XSS and Setting Changes

CSRF can be exploited against any of the functionalities in the Pricing Table by Supsystic WordPress plugin in vulnerable versions. One example:...

WordPress Minimal Coming Soon & Maintenance Mode plugin <= 2.10 - CSRF to Stored XSS and Setting Changes vulnerability

CSRF to Stored XSS and Setting Changes vulnerability found by Chloe Chamberland in WordPress Minimal Coming Soon & Maintenance Mode plugin versions = 2.10. Solution Update the WordPress Minimal Coming Soon & Maintenance Mode plugin to the latest available version at least 2.15...

Minimal Coming Soon & Maintenance Mode < 2.15 - CSRF to Stored XSS and Setting Changes

This plugin had no nonce checks on any of the settings to verify that a request came from a legitimate source, such as a logged in administrative user. Therefore, creating a CSRF to stored XSS in addition to significant setting changes. PoC...

Minimal Coming Soon & Maintenance Mode < 2.15 - CSRF to Stored XSS and Setting Changes

This plugin had no nonce checks on any of the settings to verify that a request came from a legitimate source, such as a logged in administrative user. Therefore, creating a CSRF to stored XSS in addition to significant setting changes. alert1" /...

CVE-2019-16731

The udpServerSys service in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to initiate firmware upgrades and alter device settings...

Denial Of Service (DoS)

Eclipse Jetty is vulnerable to denial of service attacks. A remote, unauthenticated attacker could exploit the flawed SETTING Frame Handler component due to the additional CPU and memory allocations required to handle setting changes causing denial of service conditions...

PT-2014-2679

Name of the Vulnerable Software and Affected Versions Related Posts by Zemanta plugin versions prior to 1.3.2 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of users for requests that change settings. Recommendations For versions prior to 1.3.2...

phpmyfaq -- multiple vulnerabilities

The phpMyFAQ team reports: An arbitrary script may be executed on the user's Internet Explorer when using an older version of the browser. If a user views a malicious page while logged in, settings may be changed unintentionally...