CVE-2022-22727

A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power...

CVE-2021-22819

A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within iframes. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 All...

CVE-2021-24936

The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks...

PT-2022-1813 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue is related to insufficient access controls in Microsoft Edge, allowing a remote attacker to elevate privileges in the system. This can enable the execution o...

CVE-2021-24641

The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modification of plugin settings, Denial-of-Service, as well as arbitrary image conversion...

CVE-2021-42539

The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and unapproved settings change...

PT-2021-5074 · Juniper Networks · 128 Technology Session Smart Router

Name of the Vulnerable Software and Affected Versions: Juniper Networks 128 Technology Session Smart Router versions prior to 4.5.11 Juniper Networks 128 Technology Session Smart Router versions 5.0 up to and including 5.0.1 Description: The usage of an internal HTTP header created an...

Emerson WirelessHART Gateway 访问控制错误漏洞

The Emerson WirelessHART Gateway is a wireless gateway from Emerson USA. An access control error vulnerability exists in Emerson WirelessHART Gateway that stems from a lack of privilege validation on system backup recovery. An attacker could use this vulnerability to take over an account and chan...

PT-2021-22861 · Cobbler +2 · Cobbler +2

Name of the Vulnerable Software and Affected Versions: Cobbler versions prior to 3.3.0 Description: The issue allows for authorization bypass, enabling modification of settings. Recommendations: For versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

The vulnerability of the microprogrammed IP cameras from Bosch, models CPP6 UHD/MP, CPP7 UHD/MP, and CPP7.3 UHD/MP, is related to the absence of authentication procedures. This allows intruders to gain unauthorized access to protected information or alter settings.

The vulnerability of the microprogrammed IP cameras from Bosch, models CPP6 UHD/MP, CPP7 UHD/MP, and CPP7.3 UHD/MP, is related to the absence of authentication procedures for critical functions. Exploiting this vulnerability can allow an unauthorized person to gain unauthorized access to protecte...

Database Backups <= 1.2.2.6 - CSRF to Backup Download

The plugin does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups. When generating a backup, the file is created in the /wp-content/uploads/database-backups directory, with ...

Design/Logic Flaw

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...

CVE-2017-7639

QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly. Successful exploitation can lead to change of the settings of Proxy Server...

Cross site request forgery (csrf)

Secutech RiS-11, RiS-22, and RiS-33 devices with firmware V5.07.52esFRI01 allow DNS settings changes via a goform/AdvSetDns?GO=wandns.asp request in conjunction with a crafted admin cookie...

e107 Cross-Site Forgery Request Vulnerability

e107 is an open source, free and PHP and MySQL based content management system CMS developed by e107 team. A cross-site request forgery vulnerability exists in e107 version 2.1.4 in plugin-installing, meta-changing, and settings-changing. A remote attacker can exploit this vulnerability to downlo...

CVE-2016-4032

Samsung SM-G920F build G920FXXU2COH2 Galaxy S6, SM-N9005 build N9005XXUGBOK6 Galaxy Note 3, GT-I9192 build I9192XXUBNB1 Galaxy S4 mini, GT-I9195 build I9195XXUCOL1 Galaxy S4 mini LTE, and GT-I9505 build I9505XXUHOJ2 Galaxy S4 devices do not block AT+USBDEBUG and AT+WIFIVALUE, which allows attacke...

WordPress plugin Yet Another Related Posts '/wp-admin/options-general.php' cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site.Yet Another Related Posts Plugin for WordPress is a wordpress plugin. The WordPress plugin Yet Another Related Posts...

ZYXEL P-660HN-T1H_IPv6 - Remote Configuration Editor Web Server Denial of Service

ZYXEL P-660HN-T1HIPv6 - Remote Configuration Editor Web Server Denial of Service | | | ' | | | | | \r\n" ." | | | | | | | | | | | | | \r\n" ." / || || ||/|| || \r\n" ." \r\n" ." \r\n"; print $banner; function Post$packet,$host try $curl = curlinit; curlsetopt$curl, CURLOPTURL, $host;...

phpMyFAQ vulnerable to cross-site request forgery

Overview phpMyFAQ is an open source FAQ software. phpMyFAQ contains a cross-site reuqest forgery vulnerability. Impact If a user views a malicious page while logged in, settings may be changed unintentionally. Solution Apply an Update Update to the latest version according to the information...