CVE-2024-2748

MEDIUM Year: 2024
CVSS v3 Score
4.3
Medium
Weakness Type
CWE-352
View all →

Vulnerability Description

A Cross Site Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker to execute unauthorized actions on behalf of an unsuspecting user. A mitigating factor is that user interaction is required. This vulnerability affected GitHub Enterprise Server 3.12.0 and was fixed in versions 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program.

Related Vulnerabilities

CVE-2005-1947

MEDIUM
CVSS:4.3(Medium)

Cross-site request forgery (CSRF) vulnerability in Invision Gallery before 1.3.1 allows remote attackers to delete albums and images as another user via a link or IMG tag to the (1) albums or (2) deli...

CWE-3522005

CVE-2014-10382

MEDIUM
CVSS:4.3(Medium)

The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.

CWE-3522014

CVE-2014-3655

MEDIUM
CVSS:4.3(Medium)

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

CWE-3522014

CVE-2015-10001

MEDIUM
CVSS:4.3(Medium)

The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege us...

CWE-3522015

CVE-2015-10130

MEDIUM
CVSS:4.3(Medium)

The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circle_thumbnail...

CWE-3522015

CVE-2015-9418

MEDIUM
CVSS:4.3(Medium)

The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.

CWE-3522015