EUVD-2023-0742

Malicious code in bioql PyPI...

EUVD-2022-4016

Malicious code in bioql PyPI...

EUVD-2023-0617

Malicious code in bioql PyPI...

CVE-2023-0735

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.5.4...

CVE-2023-0734

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4...

CVE-2023-0609

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CVE-2023-0610

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CVE-2023-0736

Cross-site Scripting XSS - Stored in GitHub repository wallabag/wallabag prior to 2.5.4...

CVE-2023-3566

A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the argument Name leads to allocation of resources. The exploit has been disclosed ...

CVE-2023-0737

wallabag version 2.5.2 contains a Cross-Site Request Forgery CSRF vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the endpoints listed below. An attacker can manipulate user data or configuration settings, and perform unauthorized actions by convincing users to follow malicious links that execute unintended...

GHSA-5PM7-CP8F-P2C2 wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities

Impact wallabag versions prior to 2.6.11 were discovered to contain multiple Cross-Site Request Forgery CSRF vulnerabilities across several endpoints. An attacker could craft a malicious link or page that, if visited by a logged-in wallabag user, could trick the user's browser into performing...

wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities

Impact wallabag versions prior to 2.6.11 were discovered to contain multiple Cross-Site Request Forgery CSRF vulnerabilities across several endpoints. An attacker could craft a malicious link or page that, if visited by a logged-in wallabag user, could trick the user's browser into performing...

Cross-site Request Forgery (CSRF)

wallabag is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to insufficient request validation, allowing attackers to arbitrarily delete user accounts via the /account/delete endpoint...

GHSA-99W8-C5F6-96PP CSRF leading to delete account in wallabag/wallabag

wallabag version 2.5.2 contains a Cross-Site Request Forgery CSRF vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the /account/delete functionality, allowing an attacker to trick the victim to delete their own account. Remediation Upgrade wallabag/wallabag to version 2.5.4 or higher. References - GitHub Commit -...

CSRF leading to delete account in wallabag/wallabag

wallabag version 2.5.2 contains a Cross-Site Request Forgery CSRF vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4...

CVE-2023-0737

wallabag version 2.5.2 contains a Cross-Site Request Forgery CSRF vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4...

CVE-2023-0737

CVE-2023-0737 : wallabag 2.5.2 is vulnerable to a Cross-Site Request Forgery (CSRF) that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. The issue is fixed in version 2.5.4. Mitigation is to upgrade to 2.5.4 or later.

CVE-2023-0737 CSRF in wallabag/wallabag

wallabag version 2.5.2 contains a Cross-Site Request Forgery CSRF vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4...