Mail.RU Group eMail - Persistent Web Vulnerability

Document Title: =============== Mail.RU Group eMail - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=709 Release Date: ============= 2012-10-09 Vulnerability Laboratory ID VL-ID: ==================================== 709 Comm...

Fortigate UTM WAF Appliance Multiple Vulnerabilities

Multiple input validation vulnerabilitiespersistent are detected in the FortiGate UTM Appliance Application. Remote attackers & low privileged user accounts can inject persistent own malicious script code to manipulate specific customer/admin requests. Affected Products: ==================...

CVE-2012-4051: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in editAccount.html in the JAMF Software Server JSS interface in JAMF Casper Suite before 8.61 allow remote attackers to hijack the authentication of administrators for requests that 1 create user accounts or 2 change passwords via a Save...

CVE-2012-5005: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/adminoptions.php in VR GPub 4.0 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an add action...

Interspire Email Marketer v6.0.1 Multiple Vulnerabilites

Exploit for php platform in category web applications Interspire Email Marketer v6.0.1 - Multiple Vulnerabilites Details: ======== 1.1 A SQL Injection vulnerability is detected in the Interspire Email Marketer v6.0.1, Email Marketing Software. The vulnerability allows an attacker remote or local...

CVE-2010-5093

SilverStripe 2.3.x contains a vulnerability in Member_ProfileForm (security/Member.php) up to version 2.3.7 that allows remote attackers to hijack user accounts by saving data using the email address (ID) of another user. Affected software: SilverStripe 2.3.x (before 2.3.7). Root cause: input han...

Barracuda SSL VPN 680 Cross Site Scripting

Exploit for php platform in category web applications Barracuda SSL VPN 680 - Cross Site Scripting Vulnerabilities Introduction: ============= The Barracuda SSL VPN is an integrated hardware and software solution enabling secure, clientless remote access to internal network resources from any Web...

Flogr v2.5.6 & v2.3 - Cross Site Script Vulnerabilities

Document Title: =============== Flogr v2.5.6 & v2.3 - Cross Site Script Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=656 Release Date: ============= 2012-07-10 Vulnerability Laboratory ID VL-ID: ==================================== 656...

eSyndiCat Pro 2.4.1 CSRF / XSS / SQL Injection

Title: ====== eSyndiCat Pro v2.4.1 - Multiple Web Vulnerabilities Date: ===== 2012-05-19 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=575 VL-ID: ===== 575 Common Vulnerability Scoring System: ==================================== 7.1 Introduction: =============...

Anchor v0.6-0.4 CMS - Persistent Web Vulnerability

Document Title: =============== Anchor v0.6-0.4 CMS - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=453 Release Date: ============= 2012-02-28 Vulnerability Laboratory ID VL-ID: ==================================== 453...

Skype Cross Site Vulnerabilities, user accounts can be Hijacked

Skype Cross Site Vulnerabilities, user accounts can be Hijacked The independent security researcher Ucha Gobejishvili has detected a cross site scripting XSS vulnerabilities affecting shop.skype.com and api.skype.com. According to a blog post on 1337 Blog, the XSS flaw discovered on these sites...

CMS wizard Cross Site Scripting

================================================================= -=CMS wizard Cross Site Scripting ================================================================= Author: XaDaL Date: 14-02-2012 vendor: http://www.cmswizard.co.uk/ tested on: windows mobile dork : powered by CMS wizard This...

XBox Security Chief Says Account Hacks Linked To Phishing, Resale Schemes

In a pattern that is becoming more common, hackers are hijacking XBox Live accounts, then tricking them out with expansion modules and other add-ons before trying to resell them to unwitting third parties. Recent XBox Live account hijacks are most likely the product of phishing and identity theft...

PT-2011-2439

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions 11.0.600x through 11.0.6300 Description A cross-site request forgery issue in the Web Interface of the Endpoint Protection Manager allows remote attackers to hijack the authentication of administrators for...

PayPal UK Twitter account hijacked by angry customer

PayPal UK Twitter account hijacked by angry customer Second high-profile hack of the week against Twitter accounts, Yesterday FOX News Twitter Account was Hacked by 5CR1PT K1DD3S & then sent false tweets saying that U.S. President Barack Obama had been shot dead. Today an angry customer of Paypal...

Mobile Devices Key To Facebook's New Log-In Approval Feature

Facebook is implementing a new opt-in, two-factor verification security feature they are calling log-in approval. The new feature will require users to enter a unique, one time code, which Facebook will send via SMS whenever a user tries to access his or her account from a new and/or unrecognized...

CVE-2011-0748

CVE-2011-0748 concerns phpList (PHPList) before 2.10.13, where multiple CSRF vulnerabilities allow remote attackers to hijack administrator sessions for actions like adding or editing administrator accounts. The issue affects phplist prior to 2.10.13 and stems from CSRF protections missing for ad...

CVE-2011-0545: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in adduser.do in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole...

Nagios XI - Multiple Cross-Site Request Forgery Vulnerabilities

source: https://www.securityfocus.com/bid/42322/info Nagios XI is prone to multiple cross-site request-forgery vulnerabilities because the application fails to properly validate HTTP requests. Successful exploit requires that the 'nagiosadmin' be logged into the web interface. Attackers can explo...

LightNEasy 3.2 admin account hijacking csrf vulnerability

Exploit for php platform in category web applications ========================================================= LightNEasy 3.2 admin account hijacking csrf vulnerability ========================================================= Author: pimpim Software Link:...