Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208 QTS 4.3.3 build 20180402 QTS 4.3.4 build 20180413 and their earlier versions could allow remote attackers to run arbitrary commands or install malware on the NAS.


Command Injection vulnerability in QTS 4.3.5 build 20181013 QTS 4.3.4 build 20181008 QTS 4.3.3 build 20180829 QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to run arbitrary commands on the NAS.


D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a command injection vulnerability via the admuser and admpass parameters in /goform/setSysAdm.


D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection.


TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.


TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute.


Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setAdInfoDetail.


Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo.


Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode.


Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setPicListItem.


Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic.


Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo.


Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/delAd.


Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic.


Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools.


Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/exeCommand.


Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac.


Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability.


Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations.


TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting.


TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyncWithHost.


TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg.


TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW.


TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/setDeviceName.


TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg.


TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate.


TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the webwlanidx parameter in /setting/setWebWlanIdx.


TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setDeviceName.


TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.


TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface.


TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.


TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi.


Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.


NETGEAR R7800 devices before 1.0.2.36 are affected by command injection.


NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.


IBM Security Secret Server 10.7 could allow a privileged user to perform unauthorized command injection due to imporoper input neutralization of special elements. IBM X-Force ID: 170011.


A security vulnerability exists in the Zingbox Inspector versions 1.293 and earlier that could allow an attacker to supply an invalid software update image to the Zingbox Inspector that could result in command injection.


In System Management Module (SMM) versions prior to 1.06 a field in the header of SMM firmware update images is insufficiently sanitized allowing post-authentication command injection on the SMM as the root user.


In System Management Module (SMM) versions prior to 1.06 the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection.


Magento versions 2.3.4 and earlier 2.2.11 and earlier (see note) 1.14.4.4 and earlier and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.


All versions of package launchpad are vulnerable to Command Injection via stop.


All versions of package gitlogplus are vulnerable to Command Injection via the main functionality as options attributes are appended to the command to be executed without sanitization.


All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require(\geojson2kml\); a(\./\ \& touch JHU\ function(){})


All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.


All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.


Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.


A vulnerability exists in The EdgeMax EdgeSwitch firmware <v1.9.1 where the EdgeSwitch legacy web interface SIDSSL cookie for admin can be guessed enabling the attacker to obtain high privileges and get a root shell by a Command injection.


A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console.


A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter.


A vulnerability in the SonicWall NSM On-Prem product allows an authenticated attacker to perform OS command injection using a crafted HTTP request. This vulnerability affects NSM On-Prem 2.2.0-R10 and earlier versions.


A vulnerability was reported in Lenovo Smart Camera X3 X5 and C2E that could allow command injection by setting a specially crafted network configuration. This vulnerability is the same as CNVD-2020-68652.


CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start service_restart service_fullstatus or service_stop parameter.


Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection.


Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection.


NETGEAR XR1000 devices before 1.0.0.58 are affected by command injection by an unauthenticated attacker.


Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.


OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.


OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.


OS Command Injection in Packagist microweber/microweber prior to 1.2.11.


A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.


OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter.


OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the \secret_key\ URL parameter.


OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the \name\ POST parameter.


OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the \name\ POST parameter.


OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the \rocommunity\ URL parameter.


System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the \ipAddr\ POST parameter.


System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the \name\ parameter.


System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the \checkport\ parameter.


System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the \groupname\ parameter.


System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the \username\ parameter during user creation.


System Command Injection in network.set_auth_settings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsername and adminPassword parameters.


System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the \sambaUser\ POST parameter.


System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the \Event\ parameter.


System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the \newname\ parameter.


System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the \ntpServerIp2\ POST parameter. Certain payloads cause the device to become permanently inoperable.


System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the \pwd\ parameter during user creation.


System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the \checkName\ parameter.


System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the \subnet\ POST parameter.


System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the \ftpUser\ POST parameter.


OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5 R3C before 2.12.15 R3 before 2.22.15 and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.


System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the payload in a POST request.


System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the \load_script\ URL parameter.


System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the \username\ URL parameter.


OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/set_router_wifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.


System command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the \username\ URL parameter.


System command injection in request_mitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the \payload\ URL parameter.


A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file which cold let a malicious user execute arbitrary code.

arbitrary code execution
command injection


A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary /opt/cgi/view/param which could let a remove malicious user execute arbitrary code.


A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi which could let a remote malicious user execute arbitrary code.


A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130 TL-SC 3130G 3171G. and 4171G 1.6.18P12s which could let a malicious user execute arbitrary code.


A command injection vulnerability in HNAP1/GetNetworkTomographySettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to execute arbitrary code.


A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitrary code on an affected system. An attacker must first obtain admin/root privileges on the SPLX console to exploit this vulnerability.


OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands via the crafted 'X-Real-IP' header.

arbitrary command execution
command injection


A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers to execute arbitrary commands via a crafted file.


OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.


OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.

command injection
arbitrary command execution


A command injection vulnerability in MVISION EDR (MVEDR) prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitrary commands through PowerShell using the EDR functionality 'execute reaction'.


A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root.


A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.


A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.


A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.


A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.


A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacharacters in the ntp field within JSON data to the /robot/initialize endpoint.


A Command Injection vulnerability exists in the web-based GUI of the 1st Gen PelcoSarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands.


A Command Injection vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands.


A command injection vulnerability exists in Moxa Inc VPort 461 Series Firmware Version 3.4 or lower that could allow a remote attacker to execute arbitrary commands in Moxa's VPort 461 Series Industrial Video Servers.


This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.


A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root.


bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.


A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier that allows for an authenticated user to execute arbitrary system commands in the CLI.


OS command injection vulnerability in the \qs\ procedure from the \utils\ module in Chicken before 4.9.0.


A command injection vulnerability in the CGI program of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary OS commands via a LAN interface.


A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.


A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account.


A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters.


A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated local user to execute arbitrary OS commands.


A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.


OS Command Injection vulnerability in debug_fcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP request.


A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.


A command injection vulnerability in the component /setnetworksettings/IPAddress of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.


A command injection vulnerability in the component /SetTriggerLEDBlink/Blink of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.


A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to execute arbitrary OS commands on a vulnerable device via a LAN interface.


A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console.


This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. QNAP have already fixed the issue in QTS 4.2.6 build 20170517 QTS 4.3.3.0174 build 20170503 and later versions.


A Command Injection vulnerability in Schneider Electric homeLYnk Controller exists in all versions before 1.5.0.


A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors which could let a malicious user run systems commands when executing a report.


A command injection vulnerability exists when the authorized user passes crafted parameter to background process in the router. This affects 360 router series products (360 Safe Router P0 P1 P2 P3 P4) the affected version is V2.0.61.58897.


A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument.


System command injection vulnerability in wifi_access in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the \timeout\ URL parameter.


This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability QNAP recommend updating Music Station to their latest versions.


This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability QNAP recommend updating QTS to their latest versions.


A command injection vulnerability in maintenance.cgi in Mutiny \Monitoring Appliance\ before 6.1.0-5263 allows authenticated users with access to the admin interface to inject arbitrary commands within the filename of a system upgrade upload.


A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.


A command injection vulnerability in the apex-publish-static-files npm module version <2.0.1 which allows arbitrary shell command execution through a maliciously crafted argument.


A command injection vulnerability in libnmapp package for versions <0.4.16 allows arbitrary commands to be executed via arguments to the range options.


A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated access to execute arbitrary OS commands on a vulnerable installation.


An command injection vulnerability in HNAP1/SetWLanApcliSettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to execute arbitrary system commands.


A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface allowing them to escalate privileges.


A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 with the improved password hashing method enabled could allow an unauthenticated attacker to execute certain commands by providing a manipulated password.


A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command or service.


A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the Captcha field to Login.


A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the PrivateLogin field to Login.


A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.


A command injection vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious attacker to cause a denial of service condition.

command injection vulnerability
denial of service
command injection


A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

command injection vulnerability
insufficient input validation
command injection


A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature

command injection vulnerability
remote code execution
command injection


A command injection vulnerability in the API of the Wavlink WL-WN531P3 router version M31G3.V5030.201204 allows an attacker to achieve unauthorized remote code execution via a malicious POST request through /cgi-bin/adm.cgi.


A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function.


The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is affected by an authenticated command injection vulnerability in multiple parameters passed to tr69_cmd.cgi. A remote attacker connected to the router's LAN and authenticated with a super user account or using a bypass authentication vulnerability like CVE-2021-20090 could leverage this issue to run commands or gain a shell as root on the target device.


A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods which could allow access to files via the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases prior to 12.1. Cisco Bug IDs: CSCvc98724.


An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables a man-in-the-middle attacker to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers that have Prisma Access 2.1 Preferred or Prisma Access 2.1 Innovation firewalls are impacted by this issue.


The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place related to a \plaintext command injection\ attack a similar issue to CVE-2011-0411.


The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place related to a \plaintext command injection\ attack a similar issue to CVE-2011-0411.


An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar executed on macOS Linux and Solaris clients when a Host Checker policy is enforced allows a man-in-the-middle attacker to perform OS command injection attacks (against a client) via shell metacharacters to the doCustomRemediateInstructions method because Runtime.getRuntime().exec() is used.


The STARTTLS implementation in WatchGuard XCS 9.0 and 9.1 does not properly restrict I/O buffering which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place related to a \plaintext command injection\ attack a similar issue to CVE-2011-0411.


The STARTTLS implementation in SCO SCOoffice Server does not properly restrict I/O buffering which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place related to a \plaintext command injection\ attack a similar issue to CVE-2011-0411.


The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place related to a \plaintext command injection\ attack a similar issue to CVE-2011-0411.


The STARTTLS implementation in the server in Ipswitch IMail 11.03 and earlier does not properly restrict I/O buffering which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place related to a \plaintext command injection\ attack a similar issue to CVE-2011-0411.


The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place related to a \plaintext command injection\ attack a similar issue to CVE-2011-0411.


The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place related to a \plaintext command injection\ attack a similar issue to CVE-2011-0411. NOTE: some of these details are obtained from third party information.


The STARTTLS implementation in qmail-smtpd.c in qmail-smtpd in the netqmail-1.06-tls patch for netqmail 1.06 does not properly restrict I/O buffering which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place related to a \plaintext command injection\ attack a similar issue to CVE-2011-0411.


The STARTTLS implementation in Postfix 2.4.x before 2.4.16 2.5.x before 2.5.12 2.6.x before 2.6.9 and 2.7.x before 2.7.3 does not properly restrict I/O buffering which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place related to a \plaintext command injection\ attack.


Algorithmic complexity vulnerability in the MCS translation daemon in mcstrans 0.2.3 allows local users to cause a denial of service (temporary daemon outage) via a large range of compartments in sensitivity labels.


Algorithmic complexity vulnerability in Opera 9.50 beta and 9.x before 9.25 allows remote attackers to cause a denial of service (CPU consumption) via a crafted bitmap (BMP) file that triggers a large number of calculations and checks.


Algorithmic complexity vulnerability in Email::Address::List before 0.02 as used in RT 4.2.0 through 4.2.2 allows remote attackers to cause a denial of service (CPU consumption) via a string without an address.


Algorithmic complexity vulnerability in FreeStyle Wiki before 3.6.2 allows remote attackers to cause a denial of service (CPU consumption) by performing a diff between large crafted pages that trigger the worst case.


Algorithmic complexity vulnerability in Hiki Wiki 0.6.0 through 0.6.5 and 0.8.0 through 0.8.5 allows remote attackers to cause a denial of service (CPU consumption) by performing a diff between large crafted pages that trigger the worst case.


Algorithmic complexity vulnerability in CoreFoundation in Mac OS X 10.3.9 and 10.4.2 allows attackers to cause a denial of service (CPU consumption) via crafted Gregorian dates.


In all Qualcomm products with Android releases from CAF using the Linux kernel a variable is uninitialized in a TrustZone system call potentially leading to the compromise of secure memory.


In iOS before 11.2 a type confusion issue was addressed with improved memory handling.


An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. It is possible (using TELNET without a password) to control the camera's pan/zoom/tilt functionality.


Insufficient control flow management for some Intel(R) Wireless Bluetooth(R) products may allow an unprivileged user to potentially enable denial of service via adjacent access.

control flow management
denial of service


Insufficient control flow management in BIOS firmware for 8th 9th 10th Generation Intel(R) Core(TM) Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow an authenticated user to potentially enable denial of service via adjacent access.


Insufficient control flow management in some Intel(R) Processors may allow an authenticated user to potentially enable a denial of service via local access.


Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.


Insufficient control flow management in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.


Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable denial of service via adjacent access.


Insufficient control flow management in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.

control flow management
escalated privilege


Insufficient control flow management in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable escalation of privilege via local access.


Insufficient control flow management in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable an escalation of privilege via local access.


Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.


Insufficient control flow management in firmware for some Intel(R) SSD Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access.


Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.


Insufficient control flow management in the Intel(R) Advisor software before version 7.6.0.37 may allow an authenticated user to potentially enable escalation of privilege via local access.


Insufficient control flow management in firmware build and signing tool for Intel(R) Innovation Engine before version 1.0.859 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.


Insufficient control flow management in some Intel(R) Graphics Drivers before version 15.45.32.5145 may allow an authenticated user to potentially enable escalation of privilege via local access.


Insufficient control flow management in the kernel mode driver for some Intel(R) Graphics Drivers before version 15.36.39.5145 may allow an authenticated user to potentially enable escalation of privilege via local access.


Insufficient control flow management in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable escalation of privilege via physical access.


Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.


Insufficient control flow management in the Open WebRTC Toolkit before version 4.3.1 may allow an unauthenticated user to potentially enable escalation of privilege via network access.


Insufficient control flow management in the API for the Intel(R) Collaboration Suite for WebRTC before version 4.3.1 may allow an authenticated user to potentially enable escalation of privilege via network access.


Insufficient control flow management in BIOS firmware 8th 9th Generation Intel(R) Core(TM) Processors and Intel(R) Celeron(R) Processor 4000 Series may allow an authenticated user to potentially enable information disclosure via local access.

control flow management
information disclosure


Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80 Intel(R) TXE versions before 3.1.80 may allow an unauthenticated user to potentially enable information disclosure via physical access.


Insufficient control flow management in firmware for some Intel(R) Data Center SSDs may allow a privileged user to potentially enable information disclosure via local access.


A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G < 2021.8.22.


A crafted NTFS image can trigger an out-of-bounds access caused by an unsanitized attribute length in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22.


A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22.


A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite) causing stack consumption in NTFS-3G < 2021.8.22.


A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G < 2021.8.22.


A crafted NTFS image can trigger a heap-based buffer overflow caused by an unsanitized attribute in ntfs_get_attribute_value in NTFS-3G < 2021.8.22.


A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22.


A crafted NTFS image can cause an integer overflow in memmove leading to a heap-based buffer overflow in the function ntfs_attr_record_resize in NTFS-3G < 2021.8.22.

crafted ntfs image
integer overflow
buffer overflow


A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.

crafted ntfs image
null pointer dereference


A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.


A crafted NTFS image can trigger an out-of-bounds read caused by an invalid attribute in ntfs_attr_find_in_attrdef in NTFS-3G < 2021.8.22.


A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.


A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.


In Open5GS 2.4.0 a crafted packet from UE can crash SGW-U/UPF.


During URL parsing a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.


An ActiveX control in McHealthCheck.dll in McAfee Virtual Technician (MVT) and ePO-MVT 6.5.0.2101 and earlier allows remote attackers to modify or create arbitrary files via a full pathname argument to the Save method.


IBM AIX 7.1 7.2 and AIX VIOS 3.1 could allow a local user to exploit a vulnerability in the gencore user command to create arbitrary files in any directory. IBM X-Force ID: 190911.


IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 179009


IBM MQ 7.5 8.0 9.0 LTS 9.1 CD and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 211403.


Multiple CRLF injection vulnerabilities in the (1) now-playing.rb and (2) xmms.pl 1.1 scripts for WeeChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.


Multiple CRLF injection vulnerabilities in callboth.php in AsteriDex 3.0 and earlier allow remote attackers to inject arbitrary shell commands via the (1) IN and (2) OUT parameters.


Multiple CRLF injection vulnerabilities in IBM Curam Social Program Management 5.2 SP1 through 6.0.5.4 allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified parameters to custom JSPs.


Multiple CRLF injection vulnerabilities in webadmin in ZNC before 0.066 allow remote authenticated users to modify the znc.conf configuration file and gain privileges via CRLF sequences in the quit message and other vectors.


Multiple CRLF injection vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to have an unknown impact via unspecified vectors involving (1) a %0a sequence in a cookie and (2) the add.php file.


Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field.


Multiple CRLF injection vulnerabilities in Adobe ColdFusion 8.0 through 9.0.1 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified tags.


A cross site request forgery (CSRF) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to create new admin accounts or change users' passwords.


A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0. An successful CSRF attacks leads to Stored Cross Site Scripting Vulnerability.


A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x as demonstrated by examples/uploadbutton.html.


A cross site request forgery (CSRF) vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php.


Multiple Cross Site Request Forgery (CSRF) vulnerabilities in the HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 exist in Web Verification Web Scanning Web Capture Monitoring and Administration and Login.


A Cross Site Request Forgery (CSRF) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allows an attacker to control the RainMachine device via the REST API.


A cross site request forgery (CSRF) in Wage-CMS 1.5.x-dev allows attackers to arbitrarily add users.


A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.


A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new administrator account without authentication.


A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the administrator such as the name e-mail and password.


A cross site request forgery (CSRF) vulnerability in the configure.html component of Ponzu 0.11.0 allows attackers to change user and administrator credentials and add or delete administrator accounts.


A Cross Site Request Forgery (CSRF) vulnerability in MonoCMS Blog 1.0 allows attackers to change the password of a user.


A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute arbitrary web scripts.


A Cross Site Request Forgery (CSRF) vulnerability exists in the loginsystem page in PHPGurukul User Registration & Login and User Management System With Admin Panel 2.1.


A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load.


A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate confirmation for sensitive transactions.


IBM Interact 8.6 9.0 9.1 and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 115085.


IBM Cloud Private 2.1.0 3.1.0 3.1.1 and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158338.


IBM Cognos Analytics 11.1.7 11.2.0 and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 209399.


IBM DataPower Gateways 7.5 7.5.1 7.5.2 and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 144887.


In FileCloud before 21.3 the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).


In versions 3.0.0-3.4.0 2.0.0-2.9.0 and 1.0.1 there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.


SAP Disclosure Management version 10.1 had insufficient protection against Cross-Site Request Forgery which could be used to trick user in to browsing malicious site.


The affected product is vulnerable to cross-site request forgery which may allow an attacker to modify different configurations of a device by luring an authenticated user to click on a crafted link on the N-Tron 702-W / 702M12-W (all versions).


IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 151256.


IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 140761.


IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890.


IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 136783.


IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158015.


IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191391.


IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 159356.


IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 153179.


Jeesns 1.4.2 contains a cross-site request forgery (CSRF) which allows attackers to escalate privileges and perform sensitive program operations.


WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add_post component that allows attackers to arbitrarily add articles in the administrator background.


A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the user has administrative privileges the attacker could alter the configuration of extract information from or reload an affected device.


A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to use a web browser and the privileges of the user to perform arbitrary actions on an affected device. For more information about CSRF attacks and potential mitigations see Understanding Cross-Site Request Forgery Threat Vectors.


A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protection mechanisms on the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.


A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series. Cisco IP Conference Phone 8831 is not affected.


A vulnerability in the web-based UI (web UI) of Cisco IOS XE Software could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the user has administrative privileges the attacker could alter the configuration execute commands or reload an affected device. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software with the HTTP Server feature enabled. The default state of the HTTP Server feature is version dependent.


A vulnerability in the web-based management interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on the device with the privileges of the user including modifying the device configuration. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an interface user to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the device with the privileges of the user. Software versions prior to 8.3.150.0 8.5.135.0 and 8.8.100.0 are affected.


A vulnerability in the web-based management interface of Cisco HyperFlex HX-Series could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system by using a web browser and with the privileges of the user.


A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications resulting in cross-site request forgery (CSRF).To exploit this vulnerability an attacker would need to create a page specifically designed to cause a aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1259.


A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications resulting in cross-site request forgery (CSRF).To exploit this vulnerability an attacker would need to create a page specifically designed to cause a aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1261.


A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user to follow a malicious link. A successful exploit could allow the attacker to use a web browser and the privileges of the user to perform arbitrary actions on the affected device.


A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.


All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability which stems from the fact that WEB applications do not adequately verify whether requests come from trusted users. An attacker can exploit this vulnerability to send unexpected requests to the server through the affected client.


The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions prior to 5.4.21 from version 6.0.0 before version 6.0.12 from version 6.1.0 before version 6.1.2 from version 7.0.0 before version 7.0.2 and from version 7.1.0 before version 7.1.3. The vulnerable plugin is used by Atlassian Jira Server and Data Center before version 8.7.0. An attacker could exploit this by tricking an administrative user into making malicious HTTP requests allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.


The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.


The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.


A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a GET request. An attacker can craft a panel/uploads/read.json?cmd=rm URL (removing this token) and send it to the victim.


Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.3 and from version 8.0.0 before 8.1.0.


Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.9 and from version 8.0.0 before 8.4.2.


The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability.


Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance which has not yet finished being installed via Cross-site request forgery (CSRF) vulnerabilities.


Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).


PHP Scripts Mall Rental Bike Script 2.0.3 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.


Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF).


MyWebSQL 3.7 has a Cross-site request forgery (CSRF) vulnerability for deleting a database via the /?q=wrkfrm&type=databases URI.


A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g. delete application users) by sending a crafted HTML document or encoded URL to a user that the website trusts. The user needs to have an active privileged session.


OSIsoft PI Vision All versions of PI Vision prior to 2019. The affected product is vulnerable to a cross-site request forgery that may be introduced on the PI Vision administration site.


An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows Cross-Site Request Forgery (CSRF) on any HTML form. An attacker can exploit the vulnerability to abuse functionalities such as change password add user add privilege and so on.


MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies allowing the cookie to be sent in cross-site requests and potentially be used in cross-site request forgery attacks.


A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery.


HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419) HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server that is potentially vulnerable to Cross-site Request Forgery.


IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 168524.


IBM StoredIQ 7.6.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158700.


IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158116.


IBM Cloud App Management 2019.3.0 and 2019.4.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 173310.


IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 172363.


A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba Operating System Software version(s): 6.x.x.x: all versions 8.x.x.x: all versions prior to 8.8.0.0. Aruba has released patches for ArubaOS that address this security vulnerability.


A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request.


Cross-site request forgery (CSRF) vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier RS-500KI firmware version Ver.01.00.0070 and earlier PR-500MI/RT-500MI firmware version Ver.01.01.0014 and earlier and RS-500MI firmware version Ver.03.01.0019 and earlier and Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier and PR-500MI/RT-500MI firmware version Ver.01.01.0011 and earlier) allow remote attackers to hijack the authentication of administrators via unspecified vectors.


In OSIsoft PI Web API and prior the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect.


A vulnerability has been identified in XHQ (All versions < V6.0.0.2). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user who must be authenticated to the web interface. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. This could allow the attacker to read or modify contents of the web application. At the time of advisory publication no public exploitation of this security vulnerability was known.


In MailEnable Enterprise Premium 10.23 the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly performing actions within the application (such as sending email adding contacts or changing settings) on behalf of the attacker.


A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.


SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request Forgery in the file upload functionality via ?Command=Upload with the Dir and File parameters.


Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.


A

cross-site

request

forgery

vulnerability

in

Jenkins

XL

TestView

Plugin

and

earlier

in

XLTestView.XLTestDescriptor#doTestConnection

allows

users

with

Overall/Read

access

to

connect

to

an

attacker-specified

URL

using

attacker-specified

credentials

IDs

obtained

through

another

method

capturing

credentials

stored

in

Jenkins.


A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method capturing credentials stored in Jenkins.


A

cross-site

request

forgery

vulnerability

in

Jenkins

JX

Resources

Plugin

and

earlier

in

GlobalPluginConfiguration#doValidateClient

allowed

attackers

to

have

Jenkins

connect

to

an

attacker-specified

Kubernetes

server

potentially

leaking

credentials.


A cross-site request forgery vulnerability in Jenkins Deploy WebLogic Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials or determine whether a file or directory with an attacker-specified path exists on the Jenkins master file system.


A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method capturing credentials stored in Jenkins.


A

cross-site

request

forgery

vulnerability

in

Jenkins

GitLab

Plugin

and

earlier

in

the

GitLabConnectionConfig#doTestConnection

form

validation

method

allowed

attackers

to

connect

to

an

attacker-specified

URL

using

attacker-specified

credentials

IDs

obtained

through

another

method

capturing

credentials

stored

in

Jenkins.


A

cross-site

request

forgery

vulnerability

in

Jenkins

Ansible

Tower

Plugin

and

earlier

in

the

TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection

form

validation

method

allowed

attackers

permission

to

connect

to

an

attacker-specified

URL

using

attacker-specified

credentials

IDs

obtained

through

another

method

capturing

credentials

stored

in

Jenkins


A

cross-site

request

forgery

vulnerability

in

Jenkins

Artifactory

Plugin

and

earlier

in

ArtifactoryBuilder.DescriptorImpl#doTestConnection

allowed

users

with

Overall/Read

access

to

connect

to

an

attacker-specified

URL

using

attacker-specified

credentials

IDs

obtained

through

another

method

capturing

credentials

stored

in

Jenkins.


A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upload malicious/forged files on a TeamMate server or replace existing uploaded files with malicious/forged files). The specific flaw exists within the handling of Upload/DomainObjectDocumentUpload.ashx requests because of failure to validate a CSRF token before handling a POST request.


A

cross-site

request

forgery

vulnerability

in

Jenkins

JClouds

Plugin

and

earlier

in

BlobStoreProfile.DescriptorImpl#doTestConnection

and

JCloudsCloud.DescriptorImpl#doTestConnection

allowed

users

with

Overall/Read

access

to

connect

to

an

attacker-specified

URL

using

attacker-specified

credentials

IDs

obtained

through

another

method

capturing

credentials

stored

in

Jenkins.


A

cross-site

request

forgery

vulnerability

in

Jenkins

Docker

Plugin

and

earlier

in

DockerAPI.DescriptorImpl#doTestConnection

allowed

users

with

Overall/Read

access

to

connect

to

an

attacker-specified

URL

using

attacker-specified

credentials

IDs

obtained

through

another

method

capturing

credentials

stored

in

Jenkins.


The workspace client openspace client app development client and REST API of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain cross site scripting (XSS) and cross-site request forgery vulnerabilities. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0 TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0 and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1.


Various exposed resources of the ViewLogging class in Jira before version 7.13.6 from version 8.0.0 before version 8.2.3 and from version 8.3.0 before version 8.3.2 allow remote attackers to modify various settings via Cross-site request forgery (CSRF).


The AddResolution.jspa resource in Jira before version 7.13.6 from version 8.0.0 before version 8.2.3 and from version 8.3.0 before version 8.3.2 allows remote attackers to create new resolutions via a Cross-site request forgery (CSRF) vulnerability.


The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6 from version 8.0.0 before version 8.2.3 and from version 8.3.0 before version 8.3.2 allows remote attackers to trigger garbage collection via a Cross-site request forgery (CSRF) vulnerability.


POST requests made by NPAPI plugins such as Flash that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks. This vulnerability affects Firefox ESR < 60.8 Firefox < 68 and Thunderbird < 60.8.


The ChangeSharedFilterOwner resource in Jira before version 7.13.6 from version 8.0.0 before version 8.2.3 and from version 8.3.0 before version 8.3.2 allows remote attackers to attack users in some cases be able to obtain a user's Cross-site request forgery (CSRF) token via a open redirect vulnerability.


A

data

modification

vulnerability

exists

in

Jenkins

Blue

Ocean

Plugins

and

earlier

in

that

allows

attackers

to

bypass

all

cross-site

request

forgery

protection

in

Blue

Ocean

API.


A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method capturing credentials stored in Jenkins.


The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection via \cookie tossing\ a CSRF cookie from a subdomain of a Jira instance.


AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery (CSRF) vulnerability in the NetCrunch web client. Successful exploitation requires a logged-in user to open a malicious page and leads to account takeover.


The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19 from version 3.0.0 before version 3.0.3 and from version 4.0.0 before version 4.0.3 allows remote attackers to uninstall plugins using a Cross-Site Request Forgery (CSRF) vulnerability on an authenticated administrator.


An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file and therefore can be embedded in third party pages and re-used against the Nighthawk web interface. This entirely bypasses the intended security benefits of the use of a CSRF-protection token.


PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Cross-Site Request Forgery (CSRF) for Edit Profile actions.


PHP Scripts Mall Online Food Ordering Script 1.0 has Cross-Site Request Forgery (CSRF) in my-account.php.


An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1 MB3280 and MB3480 devices before 3.1 MB3660 devices before 2.3 and MB3180 devices before 2.1. A predictable mechanism of generating tokens allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism.


An issue was discovered on AudioCodes Mediant 500L-MSBR 500-MBSR M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202.307. A Cross-Site Request Forgery (CSRF) vulnerability in the management web interface allows remote attackers to execute malicious and unauthorized actions because CSRFProtection=1 is not a default and is not documented.


A vulnerability in the vManage web-based UI (web UI) of the Cisco SD-WAN Solution could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected instance of vManage. An attacker could exploit this vulnerability by persuading a user to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.


A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method capturing credentials stored in Jenkins.


A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method capturing credentials stored in Jenkins.


A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method capturing the Kubernetes service account token or credentials stored in Jenkins.


A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user. If the user has administrative privileges the attacker could alter the configuration execute commands or reload an affected device.


A Cross-Site Request Forgery (CSRF) vulnerability in the user interface of Fortinet FortiSIEM 5.2.5 could allow a remote unauthenticated attacker to perform arbitrary actions using an authenticated user's session by persuading the victim to follow a malicious link.


Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.


The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability.


Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via the Password parameter to goform/RgSecurity; (2) reboot the device via the Restart parameter to goform/restart; (3) modify Wi-Fi settings as demonstrated by the WpaPreSharedKey parameter to goform/wlanSecurity; or (4) modify parental controls via the ParentalPassword parameter to goform/RgParentalBasic.


Cross-site request forgery (CSRF) vulnerability in admBase/login.page in the Admin module in JForum allows remote attackers to hijack the authentication of administrators for requests that change the user group permissions of arbitrary users via a groupsSave action.


Cross-site request forgery (CSRF) vulnerability in cmd.cgi in Icinga 1.8.5 1.9.4 1.10.2 and earlier allows remote attackers to hijack the authentication of users for unspecified commands via unspecified vectors as demonstrated by bypassing authentication requirements for CVE-2013-7106.


Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show_statuses parameter related to CVE-2013-2945.


Cross-site request forgery (CSRF) vulnerability in D-Link DAP-2253 Access Point (Rev. A1) with firmware before 1.30 allows remote attackers to hijack the authentication of administrators for requests that modify configuration settings via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in Symphony CMS before 2.3.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the sort parameter to system/authors/ related to CVE-2013-2559.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

Fat

Free

CRM

before

allow

remote

attackers

to

hijack

the

authentication

of

unspecified

victims

via

unknown

vectors

related

to

the

lack

of

a

line

in


Multiple cross-site request forgery (CSRF) vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) web/admin/ (2) web/core/ (3) web/dialog/ (4) web/fibu/ (5) web/mobile/ (6) web/task/ or (7) web/wicket/.


Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list.


cgi-bin/module//sysmanager/admin/SYSAdminUserDialog

in

Fortinet

FortiAnalyzer

before

does

not

properly

validate

the

parameter

which

allows

remote

attackers

to

perform

cross-site

request

forgery

(CSRF)

attacks.


Cross-site request forgery (CSRF) vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4 10.0 before 10.0-77.5 and 10.1 before 10.1-118.7 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.


CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.


Multiple cross-site request forgery (CSRF) vulnerabilities in Atmail Webmail Server before 7.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts (2) modify user accounts (3) delete user accounts or (4) stop the product's service.


Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers to hijack the authentication of administrators for requests that change a password via the Password and PasswordReEnter parameters aka Bug ID CSCuh37496.


Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47 4.2 before Patch 26 and 4.5 before Patch 05 as used in Documentum Edition Enterprise Edition Publish Engine and Enterprise Edition Compuset Engine allow remote attackers to hijack the authentication of administrators for requests that perform administrative actions in (1) xAdmin or (2) xDashboard.


Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bw_url parameter in the bw-videos page to wp-admin/admin.php as demonstrated by embedding a URL to a JavaScript file.


Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to hijack the authentication of administrators for requests that modify the disk erase technique settings via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts via a crafted request to admin/access_control_user_add.php; (2) modify or (3) delete user accounts; (4) perform a factory reset; (5) perform a device reboot; or (6) add (7) modify or (8) delete shares and volumes.


Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. H1) allow remote attackers to hijack the authentication of administrators for requests that change administrator credentials or enable remote management services to (1) Custom Services in Port Forwarding (2) Port Triggering Entries (3) URL Filters in Parental Control (4) Print Server settings (5) QoS Queue Setup or (6) QoS Classification Entries.


** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method as demonstrated by a /manager/html/undeploy?path= URI. NOTE: the vendor disputes the significance of this report stating that \the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.\


Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type.


The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.


Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add new testimonials via the hms-testimonials-addnew page (2) add new groups via the hms-testimonials-addnewgroup page (3) change default settings via the hms-testimonials-settings page (4) change advanced settings via the hms-testimonials-settings-advanced page (5) change custom fields settings via the hms-testimonials-settings-fields page or (6) change template settings via the hms-testimonials-templates-new page to wp-admin/admin.php.


J-Web in Juniper Junos before 10.4R13 11.4 before 11.4R7 12.1R before 12.1R6 12.1X44 before 12.1X44-D15 12.1x45 before 12.1X45-D10 12.2 before 12.2R3 12.3 before 12.3R2 and 13.1 before 13.1R3 allow remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism and hijack the authentication of administrators for requests that (1) create new administrator accounts or (2) have other unspecified impacts.


Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php.


Cross-site request forgery (CSRF) vulnerability in the Data Quality Console and Information Analyzer components in IBM InfoSphere Information Server 8.7 through FP2 and 9.1 through 9.1.2.0 allows remote attackers to hijack the authentication of arbitrary users.


Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to hijack the authentication of unspecified victims by leveraging improper configuration of SIMATIC HMI panels by the WinCC product.


Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki possibly Checkuser before 2.3 allows remote attackers to hijack the authentication of arbitrary users for requests that \perform sensitive write actions\ via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a (1) report (2) group or (3) class or possibly have other unspecified impact.


ApiBlock.php

ApiCreateAccount.php

ApiLogin.php

ApiMain.php

ApiQueryDeletedrevs.php

ApiTokens.php

and

ApiUnblock.php

in

includes/api/

in

MediaWiki

before

before

and

before

allow

remote

attackers

to

obtain

CSRF

tokens

and

bypass

the

cross-site

request

forgery

(CSRF)

protection

mechanism

via

a

JSONP

request

to

wiki/api.php.


Cross-site request forgery (CSRF) vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.11 allows remote attackers to hijack the authentication of administrators for requests that change the WiFi Security field to Deactivated via the WifiSecurity parameter.


Multiple cross-site request forgery (CSRF) vulnerabilities in Sharetronix 3.1.1 allow remote attackers to hijack the authentication of administrators for requests that (1) change configuration settings or (2) create new administrative users via unspecified vectors.


inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and (1) perform a SQL injection via an Etape_4 action or (2) execute arbitrary PHP code via an update_1 action.


Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action.


Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1 FP8 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote attackers to hijack the authentication of arbitrary users.


Coursemill Learning Management System (LMS) 6.8 constructs secret tokens based on time values which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via vectors related to cookies a different vulnerability than CVE-2013-3605.


Cross-site request forgery (CSRF) vulnerability in the Click2Sell Suite module 6.x-1.x for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete database information via vectors involving the Drupal Form API.


Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Unified MeetingPlace Solution as used in Unified MeetingPlace Web Conferencing and Unified MeetingPlace allows remote attackers to hijack the authentication of arbitrary users aka Bug IDs CSCui45209 and CSCui44674.


Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php (2) advertisers via admin/advertiser-delete.php (3) banners via admin/banner-delete.php (4) campaigns via admin/campaign-delete.php (5) channels via admin/channel-delete.php (6) affiliate websites via admin/affiliate-delete.php or (7) zones via admin/zone-delete.php.


Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DSL-2740B Gateway with firmware EU_1.00 allow remote attackers to hijack the authentication of administrators for requests that (1) enable or disable Wireless MAC Address Filters via a wlFltMode action to wlmacflt.cmd (2) enable or disable firewall protections via a request to scdmz.cmd or (3) enable or disable remote management via a save action to scsrvcntr.cmd.


Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x 3.x and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that commit an attachment change via an update action.


Cross-site request forgery (CSRF) vulnerability in testingLibraryAction.do in the Training Center testing library in Cisco WebEx Training Center allows remote attackers to hijack the authentication of arbitrary users for requests that delete tests aka Bug ID CSCzu81067.


Multiple cross-site request forgery (CSRF) vulnerabilities in the server in Cisco Unified MeetingPlace before 7.1(2.2000) allow remote attackers to hijack the authentication of unspecified victims via unknown vectors aka Bug ID CSCuc64903. NOTE: some of these details are obtained from third party information.


Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.


Multiple cross-site request forgery (CSRF) vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.0.2 allow remote attackers to hijack the authentication of administrators for requests that modify (1) settings or (2) policies or (3) restart the device via a rebootme action to system/maintenance/shutdown.


Cross-site request forgery (CSRF) vulnerability in the elFinder file manager module 6.x-0.x before 6.x-0.8 and 7.x-0.x before 7.x-0.8 for Drupal allows remote attackers to hijack the authentication of unspecified victims to create modify or delete files via unknown vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management (2) live management and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.


Mozilla Firefox before 22.0 Firefox ESR 17.x before 17.0.7 Thunderbird before 17.0.7 and Thunderbird ESR 17.x before 17.0.7 do not prevent the inclusion of body data in an XMLHttpRequest HEAD request which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web site.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

ownCloud

before

and

before

allow

remote

attackers

to

hijack

the

authentication

of

users

for

requests

that

change

the

timezone

for

the

user

via

the

lat

and

lng

parameters

to

disable

or

enable

the

automatic

timezone

detection

via

the

timezonedetection

parameter

to

import

user

accounts

via

the

parameter

to

overwrite

user

files

via

the

operation

parameter

to

or

change

the

authentication

server

URL

via

unspecified

vectors

to


Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the default view via the v parameter to apps/calendar/ajax/changeview.php mount arbitrary (2) Google Drive or (3) Dropbox folders via vectors related to addRootCertificate.php dropbox.php and google.php in apps/files_external/ajax/ or (4) change the authentication server URL via unspecified vectors to apps/user_webdavauth/settings.php.


ownCloud Server before 4.5.7 does not properly check ownership of calendars which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability but due to lack of details it is uncertain what the root cause is.


Cross-site request forgery (CSRF) vulnerability in the Taxonomy Manager (taxonomy_manager) module 6.x-2.x before 6.x-2.2 and 7.x-1.x before 7.x-1.0-rc1 for Drupal allows remote attackers to hijack the authentication of users with 'administer taxonomy' permissions via unspecified vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I router with firmware 40.19.36 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via the username and user_level parameters or (2) enable remote administration via the is_telnet_primary and is_telnet_secondary parameters.


Cross-site request forgery (CSRF) vulnerability in cgi-bin/create_user.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a NEW USER action.


Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21 3.6.x before 3.6.12 and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions.


Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111 140NOE77101 and 140NWM10000; M340 BMXNOC0401 BMXNOE0100x and BMXNOE011xx; and Premium TSXETY4103 TSXETY5103 and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands as demonstrated by modifying HTTP credentials.


Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N AtermWR8600N AtermWR8370N AtermWR8160N AtermWM3600R and AtermWM3450RN routers allow remote attackers to hijack the authentication of administrators for requests that (1) initialize settings or (2) reboot the device.


Cross-site request forgery (CSRF) vulnerability in the Software Use Analysis (SUA) application before 1.3.3 in IBM Tivoli Endpoint Manager 8.2 allows remote attackers to hijack the authentication of arbitrary users via a web site that contains crafted Flash Action Message Format (AMF) messages.


Multiple cross-site request forgery (CSRF) vulnerabilities in action.php in Leed (Light Feed) possibly before 1.5 Stable allow remote attackers to hijack the authentication of administrators for unspecified requests related to the lack of an anti-CSRF token.


Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the \List of alternative recipients\ via the mailonupdate_mailto parameter in the mail-on-update page to wp-admin/options-general.php. NOTE: a third party claims that 5.2.1 and 5.2.2 are also vulnerable but the issue might require a separate CVE identifier since this might reflect an incomplete fix.


Cross-site request forgery (CSRF) vulnerability in addressbook/register/delete_user.php in PHP Address Book 8.2.5 allows remote attackers to hijack the authentication of administrators for requests that delete accounts a different vulnerability than CVE-2013-0135.1.


Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0 Cybozu Dezie before 8.0.7 and Cybozu Mailwise before 5.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords.


Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that add or edit an ad via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in cgi-bin/system_setting.exe in Belkin F5D8236-4 v2 allows remote attackers to hijack the authentication of administrators for requests that open the remote management interface on arbitrary ports via the remote_mgmt_enabled and remote_mgmt_port parameters.


Cross-site request forgery (CSRF) vulnerability in goform/usermanage in Grandstream GXV3501 GXV3504 GXV3601 GXV3601HD/LL GXV3611HD/LL GXV3615W/P GXV3651FHD GXV3662HD GXV3615WP_HD GXV3500 and possibly other camera models allows remote attackers to hijack the authentication of unspecified victims for requests that add users.


Cross-site request forgery (CSRF) vulnerability in the web framework on Cisco IronPort Web Security Appliance (WSA) devices Email Security Appliance (ESA) devices and Content Security Management Appliance (SMA) devices allows remote attackers to hijack the authentication of arbitrary users aka Bug IDs CSCuh70263 CSCuh70323 and CSCuh26634.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hijack the authentication of unspecified victims for requests that (1) store XSS sequences or (2) delete entries.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Loftek Nexus 543 IP Camera allow remote attackers to hijack the authentication of unspecified victims for requests that change (1) passwords or (2) firewall configuration as demonstrated by a request to set_users.cgi.


Cross-site request forgery (CSRF) vulnerability in cgi-bin/admin/usrgrp.cgi in AirLive POE2600HD POE250HD POE200HD OD-325HD OD-2025HD OD-2060HD POE100HD and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests that add users.