CSprite <= 1.1 - Cross-Site Request Forgery

Description The CSprite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a...

SureTriggers < 1.0.24 - Cross-Site Request Forgery

Description The SureTriggers plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.23. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized acti...

Frontier Post <= 6.1 - Cross-Site Request Forgery

Description The Frontier Post plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.1. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized action...

BitPay Checkout for WooCommerce < 5.0.0 - Missing Authorization

Description The BitPay Checkout for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an unknown function in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to perform an unauthorized...

Authentication flaw

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in tvOS 16.3, macOS Ventura 13.2, watchOS 9.3, iOS 16.3 and iPadOS 16.3. An app may be able to bypass Privacy preferences...

Nextcloud: Enabling Birthday Contact to any user

The "Birthday Contacts" feature could be enabled for any user, including administrators and super administrators, from a low privileged account within the Nextcloud application by navigating to the calendar settings and intercepting a specific request...

Jenkins Bazaar Plugin 跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

WordPress Plugin WP Reroute Email 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

HackerOne: HackerOne Support System Doesn't Require Any Authentication May Lead Unauthorized Action

The HackerOne support system did not require any authentication, allowing anyone to open a support ticket for another user's account. This could potentially lead to unauthorized actions being taken on the account...

PT-2023-24391 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Foxy Fitzroy versions where ROS VERSION is 2 and ROS PYTHON VERSION is 3 Description: An unauthorized node injection issue has been identified, which could allow a malicious user to inject malicious ROS2 nodes into the system remotely...

CVE-2023-26097

An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behaviour may not be blocked...

CVE-2022-46368

Rumpus - FTP server version 9.0.7.1 Cross-site request forgery CSRF – vulnerability may allow unauthorized action on behalf of authenticated users...

Cross site request forgery (csrf)

Rumpus - FTP server version 9.0.7.1 Cross-site request forgery CSRF – vulnerability may allow unauthorized action on behalf of authenticated users...

Rumpus FTP Web File Manager 跨站请求伪造漏洞

Rumpus FTP Web File Manager is a file transfer server. A security vulnerability exists in Rumpus FTP Web File Manager version 9.0.7.1, which originates from a vulnerability that could allow unauthorized operation on behalf of an authenticated user...

Security Bulletin: A vulnerability has been identified in IBM Elastic Storage System GUI where authorised user can execute unauthorized function (CVE-2020-4378)

Summary A security vulnerability has been identified in all levels of IBM Elastic Storage System 3000 GUI. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2020-4378 DESCRIPTION: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a privileged authenticated user to...

CVE-2022-25608 WordPress Yoo Slider – Image Slider & Video Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to slider Duplicate/Delete

Cross-Site Request Forgery CSRF in Yoo Slider – Image Slider & Video Slider WordPress plugin allows attackers to trick authenticated users into unwanted slider duplicate or delete action...

CVE-2022-25815

PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent...

CVE-2022-25814

PendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent...

Spoofing

PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent...

Spoofing

PendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent...