#cwe-352

共收录 791 条相关情报。

漏洞预警2026-08-12 发布INFO

Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash i...

CVE-2026-47228

Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-11 发布INFO

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sa...

CVE-2026-73222

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-306 #cwe-352

漏洞预警2026-08-11 发布INFO

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /account/follow * /account/delete_notification * /...

CVE-2026-73162

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /acco

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-11 发布INFO

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool ...

CVE-2026-19418

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, wher

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-352

漏洞预警2026-08-11 发布INFO

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a ...

CVE-2026-66775

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthent

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

安全公告2026-08-11 发布INFO

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions...

CVE-2025-32736

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may all

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-352 #severity:medium

漏洞预警2026-08-10 发布INFO

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-c...

CVE-2025-32736

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may all

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-10 发布INFO

A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authentic...

CVE-2026-72578

A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-10 发布INFO

Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2.

CVE-2026-66642

Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-07 发布CRITICAL

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP A...

CVE-2026-46409

OpenYak 是一款本地优先的智能体运行时，专门用于可靠地调用工具的模型，并在此基础上提供桌面工作区。在 1.1.3 版本之前，OpenYak 的桌面后端存在一个严重安全缺陷：其 HTTP API 被绑定在 127.0.0.1 的随机端口

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-306 #cwe-346 #cwe-352 #cwe-942

漏洞预警2026-08-07 发布INFO

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to lo...

CVE-2026-16262

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-06 发布INFO

Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.

CVE-2026-66686

Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-06 发布INFO

Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.

CVE-2026-66681

Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-06 发布INFO

Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

CVE-2026-28172

Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-06 发布INFO

Hubzilla 11.2.1 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post() that allows unauthenticated att...

CVE-2026-70556

Hubzilla 11.2.1 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-06 发布INFO

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the ...

CVE-2025-13394

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Reque

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-06 发布INFO

PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), all versions up to ...

CVE-2026-14313

PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-639

漏洞预警2026-08-06 发布INFO

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwritin...

CVE-2026-14204

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, all

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-05 发布INFO

Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams id...

CVE-2026-66885

Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's b

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-08-05 发布INFO

A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specif...

CVE-2026-70434

A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to c

历史摘要 · 未重新核验 · NVD

#cve #cwe-352