GHSA-P8GP-899C-JVQ9 Wallabag user can reset data unintentionally

Description wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily reset annotations, entries and tags, by the GET request to /reset/annotations, /reset/entries, /reset/tags, /reset/archived. This vulnerability has a CVSSv3.1 score of 4.3. You...

Wallabag user can delete own API client unintentionally

Description wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily delete API key via /developer/client/delete/id This vulnerability has a CVSSv3.1 score of 6.5. You should immediately patch your instance to version 2.6.3 or higher if you have...

GHSA-GJVC-55FW-V6VQ Wallabag user can delete own API client unintentionally

Description wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily delete API key via /developer/client/delete/id This vulnerability has a CVSSv3.1 score of 6.5. You should immediately patch your instance to version 2.6.3 or higher if you have...

Duplicate Advisory: Wallabag user can reset data unintentionally

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p8gp-899c-jvq9. This link is maintained to preserve external references. Original Description Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...

GHSA-GVVX-FC6P-2H9X Duplicate Advisory: Wallabag user can delete own API client unintentionally

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gjvc-55fw-v6vq. This link is maintained to preserve external references. Original Description Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...

Duplicate Advisory: Wallabag user can delete own API client unintentionally

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gjvc-55fw-v6vq. This link is maintained to preserve external references. Original Description Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...

GHSA-RWPG-4C4C-V3R4 Duplicate Advisory: Wallabag user can reset data unintentionally

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p8gp-899c-jvq9. This link is maintained to preserve external references. Original Description Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...

CVE-2023-4455

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...

CVE-2023-4455 Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...

CVE-2023-4455

Cross-Site Request Forgery (CSRF) in wallabag/wallabag prior to 2.6.3. Public sources describe an attacker‑facing flaw in the delete API flow (DeveloperController.php) where CSRF validation is insufficient, enabling arbitrary API key deletion via a crafted GET to /developer/client/delete/{id}. CV...

CVE-2023-4455 Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...

CVE-2023-4455 Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...

CVE-2023-4454

The CVE-2023-4454 entry concerns wallabag/wallabag prior to version 2.6.3. The vulnerability is a Cross-Site Request Forgery (CSRF) in the ConfigController.php reset actions, caused by missing CSRF protection. This could allow an attacker to trigger GET requests to /reset/annotations, /reset/entr...

CVE-2023-4454 Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...

wallabag 跨站请求伪造漏洞

wallabag is a web application that allows you to save web pages for later reading. A cross-site request forgery vulnerability exists in wallabag versions prior to 2.6.3, which stems from a vulnerability that allows an attacker to arbitrarily delete client API keys...

PT-2023-29269 · Wallabag · Wallabag

Name of the Vulnerable Software and Affected Versions: wallabag versions prior to 2.6.3 Description: The issue is related to Cross-Site Request Forgery CSRF in the wallabag GitHub repository. This allows attackers to arbitrarily reset annotations, entries, and tags by sending a GET request to...

wallabag 跨站请求伪造漏洞

wallabag is a web application that allows you to save web pages for later reading. A cross-site request forgery vulnerability exists in wallabag versions prior to 2.6.3, which can be exploited by an attacker to arbitrarily delete comments, entries, and tags from an aggrieved user via a GET reques...

Denial Of Service

wallabag/wallabag is vulnerable to Denial Of Service. The vulnerability exists due a lack of a max size checks in the name parameter which allows an attacker to cause a denial of service...