7783 matches found
CVE-2019-16993
In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...
Cross site request forgery (csrf)
In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...
CVE-2019-16993
In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...
CVE-2019-16993
In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...
CVE-2019-16993
CVE-2019-16993 affects phpBB
Session Token In URL
PhpBB sends the session token via a GET parameter in the URL. Due to the way phpbb works, having the session ID is not enough for a remote attacker to gain access to the application since the session tokens are tied to an IP address. However, with knowledge of the administrator's session ID, the...
CVE-2019-13376
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...
Cross site request forgery (csrf)
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...
CVE-2019-13376
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...
Design/Logic Flaw
ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated remote attackers to perform administrative actions...
Open redirect
ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext...
CVE-2019-5505
ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext...
CVE-2019-5505
The CVE-2019-5505 issue affects NetApp ONTAP Select Deploy admin utility versions 2.2–2.12.1, where credentials are transmitted in plaintext. The combined documents identify the root cause as unencrypted credential handling in the deploy utility, leading to potential credential disclosure. The vu...
CVE-2019-5504
The CVE-2019-5504 entry concerns ONTAP Select Deploy administration utility versions 2.12 and 2.12.1. The vulnerability arises because an HTTP service is bound to the network, allowing unauthenticated remote attackers to perform administrative actions. Documents confirm the affected product (ONTA...
CVE-2019-5504
ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated remote attackers to perform administrative actions...
Trump’s Ukraine Mess Feels a Little Too Familiar
The unfolding drama ties two key threads of the Trump era: foreign interference in US elections and the president's distrust of his own intel agencies...
Exploit for OS Command Injection in Webmin
Make-and-Break Create and exploit a vulnerable Virtual Mac...
CVE-2019-14913
An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel...