PT-2014-7212

Name of the Vulnerable Software and Affected Versions M/Monit versions 3.3.2 and earlier Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that change user passwords. This is achieved via the fullname and password parameters...

PT-2014-2654

Name of the Vulnerable Software and Affected Versions Belkin F5D8236-4 version v2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that open the remote management interface on arbitrary ports via the remote mgm...

PT-2014-2650

Name of the Vulnerable Software and Affected Versions Linksys WRT310Nv2 version 2.0.0.1 Description A cross-site request forgery issue affects the apply.cgi component, allowing remote attackers to hijack administrator authentication for requests that modify passwords and remote management ports...

PT-2014-2658

Name of the Vulnerable Software and Affected Versions Belkin N300 F7D7301v1 router Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack administrator authentication for requests that modify configuration. This is related to the apply.cgi component...

PT-2014-2656

Name of the Vulnerable Software and Affected Versions Belkin N900 router affected versions not specified Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack administrator authentication for requests that change configuration settings, including password...

PT-2014-6335

Name of the Vulnerable Software and Affected Versions Improved user search in backend plugin versions prior to 1.2.5 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack administrator authentication for requests that insert XSS sequences via the iusib me...

CVE-2014-5199: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the WordPress File Upload plugin wp-file-upload before 2.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are...

CVE-2014-5100

Multiple cross-site request forgery CSRF vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new super user account via a request to admin/users/add, 2 insert cross-site scripting XSS sequences via the apikeylabel...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Simple Share Buttons Adder plugin before 4.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 ssbasharetext parameter in a save...

CVE-2014-4718

Multiple cross-site request forgery CSRF vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication of administrators for requests that 1 add Super users via a request to admin/usercreate.php or conduct cross-site scripting XSS attacks via the 2 email or 3 subje...

CVE-2014-3778

Multiple cross-site request forgery CSRF vulnerabilities in goform/RgDdns in ARRIS formerly Motorola SBG901 SURFboard Wireless Cable Modem allow remote attackers to hijack the authentication of administrators for requests that 1 change the dns service via the DdnsService parameter, 2 change the...

PT-2014-4974

Name of the Vulnerable Software and Affected Versions Huawei E303 modems with software 22.157.18.00.858 Huawei Web UI version 11.010.06.01.858 Description A cross-site request forgery CSRF issue exists in the api/sms/send-sms endpoint of the Web UI, allowing remote attackers to hijack administrat...

PT-2014-2553

Name of the Vulnerable Software and Affected Versions Mail On Update plugin versions prior to 5.2.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the...

CVE-2013-2107: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdatemailto parameter in the mail-on-update pag...

CVE-2014-2989

Cross-site request forgery CSRF vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to Users/add...

KLA10291 Multiple vulnerabilities in PaperCut

Multiple serious vulnerabilities have been found in PaperCut. Malicious users can exploit these vulnerabilities to cause denial of service or hijack administrators auth. Below is a complete list of vulnerabilities 1. A CSRF vulnerability can be exploited remotely via unspecified vectors; 2. An...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user...

PT-2014-2614

Name of the Vulnerable Software and Affected Versions WP-Print plugin versions prior to 2.52 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that manipulate plugin settings. Recommendations For WP-Print plugin...

LifeSize UVC Authenticated Remote Command Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "LifeSize UVC Authenticated RCE via Ping", 'Description' = %q When authenticated as an administrator on LifeSize UVC 1.2.6, an attacke...

CVE-2014-0126

Cross-site request forgery CSRF vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that import an IMS Enterprise file...