2009 HP report says ACL checks fail for multi-principal access
HP Labs argued missing cross-message state lets clickjacking and CSRF bypass ACL decisions on many web applications.
Stories per day · 30 days
2 RSS
Relatedweb-applications2access-control1acl1advisory1amazon-provider1apache-airflow1arkime1authentication-bypass1aws1cisa1clickjacking1critical-infrastructure1denial-of-service1http1ics1malcolm1method-interchange1rabbitmq1
26 stories, newest first · one card per story
Stories tagged #csrf
POST-to-GET interchange found on 407 of Tranco top 10k
Some equivalent GETs accept CSRF tokens rejected on POST and return cacheable responses.
Airflow Amazon provider before 9.38.0 has SAML login CSRF (CVE-2026-86467)
The AWS auth manager accepts a SAML assertion without matching it to the browser that started login.
USN-8933-1: RabbitMQ Server vulnerabilities
Ubuntu’s USN-8933-1 fixes RabbitMQ issues that could enable CSRF, XSS, and denial of service.
CISA Malcolm
CISA patched high-severity Malcolm flaws through version 26.08.0, including authentication bypass and SSRF.
CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin
Apache APISIX feishu-auth and dingtalk-auth allow session fixation through a crafted link (CVE-2026-94220).
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Elementor CSRF in versions 4.3.0 and 4.3.1 can create admin accounts after one clicked link.
CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation
Apache Roller 6.1.5 CSRF filters accept requests without the salt token, enabling forged state-changing actions.
Elementor WordPress flaw lets attackers create admin accounts
Elementor 4.3.0 and 4.3.1 CSRF bug lets a malicious link create WordPress admin accounts.
Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites
Elementor 4.3.0 and 4.3.1 have a CVSS 8.8 CSRF bug that can create a new administrator account.
SourceHut account takeover via build logs (XSS in ansi2html.py)
Stored XSS in SourceHut's ansi2html can run script from CI build logs and enable account takeover.
On-prem VeloCloud Orchestrator under attack, only some versions patched
Arista warns the actively exploited CVSS 10.0 VeloCloud Orchestrator flaw CVE-2026-93952 has patches for only some affected release trains.
WordPress Click2Shell flaw lets hackers execute PHP on the server
Public PoC shows WordPress Click2Shell can run PHP if an administrator opens a crafted link.
1
Click2Shell WordPress Flaw Lets Attackers Gain RCE With a Single Malicious Link
Researchers disclosed Click2Shell, a WordPress exploit chain that turns a single malicious link clicked by an admin into remote code execution; fixed in WordPress 7.1.1.
4
Click2Shell: The RCE WordPress 7.1.1 Just Patched
WordPress 7.1.1 patches Click2Shell, a CSRF-to-selector-injection chain letting attackers gain remote code execution via crafted links clicked by admins.
3
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
WordPress 7.1.1 patches Click2Shell, a flaw letting crafted links force-install themes on admin visits, chainable to remote code execution; no exploitation observed.
3
HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)
RFC 10008 standardizes the HTTP QUERY method, creating potential WAF inspection bypasses, cache poisoning, and CSRF gaps because most defenses don't recognize the new verb.
1
ST Engineering iDirect iQ-Series Terminals (Update A)
CISA advisory details four flaws in ST Engineering iDirect iQ-Series VSAT terminals <=4.5.2.1, enabling device data theft, CSRF-driven reboots, and local privilege escalation.
Tycon Systems TPDIN-Monitor-WEB3
CISA reports three flaws (hard-coded credentials, CSRF, missing authorization) in Tycon TPDIN-Monitor-WEB3 <=2.2.9 enabling MitM, credential theft, or device resets.
1
Ebyte NA111-M
CISA reports 13 vulnerabilities, including CVSS 9.8 missing-authentication flaws, in Ebyte NA111-M firmware that allow full device compromise.
Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command Execution
NASA/JPL's AIT-GUI web console (CVSS 9.4) lacked authentication and CSRF protection, letting anyone send unauthenticated commands to spacecraft instruments; fixed in 2.5.2.
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.
GitLab Patches Critical Unauthenticated GraphQL Vulnerability
GitLab issued an emergency patch for a critical unauthenticated GraphQL flaw (CVE-2026-19478, CVSS 9.4) enabling remote modification or deletion of public projects.
Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)
GitLab patched a critical unauthenticated code injection flaw CVE-2026-19478 (CVSS 9.4) enabling modification or deletion of public projects; upgrades urged.