Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-qp42-5pj7-4ccm: Concrete CMS Cross Site Request Forgery (CSRF)

Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated.

ghsa
#csrf#web#git#auth

Concrete CMS Cross Site Request Forgery (CSRF)

Moderate severity GitHub Reviewed Published Dec 25, 2023 to the GitHub Advisory Database • Updated Dec 27, 2023

ghsa: Latest News

GHSA-hxf5-99xg-86hw: cap-std doesn't fully sandbox all the Windows device filenames