CVE-2015-10004

Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC...

CVE-2018-1000809

privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user== to /validate/check url. This vulnerability appears to have been fixed in 2.23.2...

Improper Authentication Bypass

github.com/hashicorp/vault is vulnerable to improper authentication bypass. The vulnerability is due to the Azure Auth method not correctly validating claims in Azure-issued tokens, allowing potential bypass of the boundlocations parameter on login...

Intermittent authentication failures with Oauth

User unable to authenticate due to token validation failure. Error in logs: "OAUTH: verify JWT: Could not find key for 'kid' in configuration, cannot verify jwt"...

PT-2025-20151 · Iqonic Design · Iqonic Design Graphina

Name of the Vulnerable Software and Affected Versions: Iqonic Design Graphina versions 3.0.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows PHP Local File Inclusion. This means an attacker could potentially trick a user into performing unintended...

GHSA-F9CH-H8J7-8JWG Hashicorp Vault Community vulnerable to Incorrect Authorization

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

Hashicorp Vault Community vulnerable to Incorrect Authorization

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

CVE-2025-3879 Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

CVE-2025-3879

CVE-2025-3879 affects Vault (Vault Community and Vault Enterprise) where the Azure Auth method did not correctly validate claims in the Azure-issued token, allowing potential bypass of the bound_locations restriction on login. The issue is described across multiple sources and is evidenced by OSV...

CVE-2025-32354

In Zimbra Collaboration ZCS 9.0 through 10.1, a Cross-Site Request Forgery CSRF vulnerability exists in the GraphQL endpoint /service/extension/graphql of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying...

PT-2025-17765 · Unknown · Scss-Library

Name of the Vulnerable Software and Affected Versions: SCSS-Library versions 0.4.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. Recommendations: For SCSS-Library versions 0.4.1 and earlier, as a temporary...

PT-2025-17805 · Zalo · Zalo Official Live Chat

Name of the Vulnerable Software and Affected Versions: Zalo Official Live Chat versions 1.0.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

PT-2025-17510 · Unknown · Cm Ad Changer

Name of the Vulnerable Software and Affected Versions: CM Ad Changer versions n/a through 2.0.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions n/a through 2.0.5, update to a version later than 2.0.5...

PT-2025-16616 · Unknown · Ever Accounting

Name of the Vulnerable Software and Affected Versions: Ever Accounting versions n/a through 2.1.5 Description: A Cross-Site Request Forgery CSRF issue affects Ever Accounting, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions n/a through 2.1.5, updat...

PT-2025-15733 · Unknown · Abozain Albanna Customize Login Page

Name of the Vulnerable Software and Affected Versions: AboZain Albanna Customize Login Page versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

PT-2025-15848 · Brizy Pro · Brizy Pro

Name of the Vulnerable Software and Affected Versions: Brizy Pro versions 2.6.1 and earlier Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue affects Brizy Pro, enabling Cross Site Request Forgery. Recommendations: For...

PT-2025-15729 · Unknown · Purab Seo Meta Tags

Name of the Vulnerable Software and Affected Versions: Purab Seo Meta Tags versions 1.4 and earlier Description: A Cross-Site Request Forgery CSRF issue affects Purab Seo Meta Tags, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For Purab Seo Meta Tags version...

PT-2025-14911 · Unknown · Libro De Reclamaciones Y Quejas

Name of the Vulnerable Software and Affected Versions: Libro de Reclamaciones y Quejas versions 0.9 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 0.9 and earlier, consider implementing...

PT-2025-14219 · Unknown · Digireturn Simple Fixed Notice

Name of the Vulnerable Software and Affected Versions: digireturn Simple Fixed Notice versions 1.6 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of atta...

Azure Linux 3.0 Security Update: application-gateway-kubernetes-ingress / azcopy / cert-manager / cf-cli / coredns (CVE-2024-51744)

The version of application-gateway-kubernetes-ingress / azcopy / cert-manager / cf-cli / coredns installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-51744 advisory. - golang-jwt is a Go implementation...