https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 22:28:48 +0000 https://cve.radiocsirt.org/vuln/certfr-2021-avi-395 certfr-2021-avi-395 https://cve.radiocsirt.org/vuln/certfr-2021-avi-395 https://cve.radiocsirt.org/vuln/cnvd-2021-13225 cnvd-2021-13225 https://cve.radiocsirt.org/vuln/cnvd-2021-13225 https://cve.radiocsirt.org/vuln/euvd-2026-215956 EUVD-2026-215956 https://cve.radiocsirt.org/vuln/euvd-2026-215956 https://cve.radiocsirt.org/vuln/fkie_cve-2021-26296 <p>In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.</p> <p>In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-26296 https://cve.radiocsirt.org/vuln/ghsa-gq67-pp9w-43gp <p><strong>Affected:</strong> Maven: org.apache.myfaces.core:myfaces-core-module</p> <p>In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.</p> <p>Mitigation: Existing web.xml configuration parameters can be used to direct MyFaces to use SecureRandom for CSRF token generation:</p> <p>org.apache.myfaces.RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN=secureRandom org.apache.myfaces.RANDOM_KEY_IN_CSRF_SESSION_TOKEN=secureRandom org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN=secureRandom</p> <p><strong>Affected:</strong> Maven: org.apache.myfaces.core:myfaces-core-module</p> <p>In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.</p> <p>Mitigation: Existing web.xml configuration parameters can be used to direct MyFaces to use SecureRandom for CSRF token generation:</p> <p>org.apache.myfaces.RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN=secureRandom org.apache.myfaces.RANDOM_KEY_IN_CSRF_SESSION_TOKEN=secureRandom org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN=secureRandom</p> https://cve.radiocsirt.org/vuln/ghsa-gq67-pp9w-43gp https://cve.radiocsirt.org/vuln/gsd-2021-26296 gsd-2021-26296 https://cve.radiocsirt.org/vuln/gsd-2021-26296