CVE-2023-45857-Demo

Demo to verify the behavior of Axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev in the app container 3. Access http://app.localhost 4. Verify that the cookie XSRF-TOKEN is set in the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false SameSite...

CVE-2022-42188

In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server...

EUVD-2022-7079

Malicious code in bioql PyPI...

Lavalite v9.0.0 - XSRF-TOKEN cookie File path traversal Vulnerability

Exploit Title: Lavalite v9.0.0 - XSRF-TOKEN cookie File path traversal Exploit Author: nu11secur1ty Vendor: https://lavalite.org/ Software: https://github.com/LavaLite/cms/releases/tag/v9.0.0 Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/LavaLite Description: The...

GHSA-CM22-88QR-7FFH Lavalite vulnerable to Arbitrary File Read via Directory Traversal

In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server...

CVE-2022-42188

In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server...

CVE-2022-42188: Improper Limitation of a Pathname to a Restricted Directory

In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server...

PT-2022-26302 · Lavalite · Lavalite

Name of the Vulnerable Software and Affected Versions: Lavalite version 9.0.0 Description: The issue allows for path traversal attacks through the XSRF-TOKEN cookie, enabling read access to arbitrary files on the server. Recommendations: For Lavalite version 9.0.0, consider restricting access to...

CVE-2022-42188

In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server...

CVE-2020-28452

This affects the package com.softwaremill.akka-http-session:core2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core2.11; the package com.softwaremill.akka-http-session:core2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request...

CVE-2020-28452 Cross-site Request Forgery (CSRF)

This affects the package com.softwaremill.akka-http-session:core2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core2.11; the package com.softwaremill.akka-http-session:core2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request...