Ubee EVW3200 - Cross-Site Request Forgery

Exploit Title: Ubee EVW3200 - Multiple Cross Site Request Forgery Google Dork: N/A Date: 02-03-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.ubeeinteractive.com/ Software Link: http://www.ubeeinteractive.com/products/cable?fieldproductcatetorytid=20 Version: All Tested on:...

Slack: State parameter missing on google OAuth

Hi, State parameter i.e anti-csrf token to prevent session hijacking attacks is missing on Google OAuth i.e...

Joomla! JomSocial component < 3.1.0.1 - Remote code execution

------------------------------------------------------------- Joomla! JomSocial component 3.1.0.1 - Remote code execution ------------------------------------------------------------- == Description == - Software link: http://www.jomsocial.com/ - Affected versions: All versions = 2.6 and 3.1.0.1...

CVE-2013-2628

Multiple cross-site request forgery CSRF vulnerabilities in action.php in Leed Light Feed, possibly before 1.5 Stable, allow remote attackers to hijack the authentication of administrators for unspecified requests, related to the lack of an anti-CSRF token...

CVE-2013-2628

Leed (Light Feed) contains CSRF vulnerabilities in action.php (CVE-2013-2628), likely present before 1.5 Stable. The issue arises from missing anti-CSRF tokens, allowing an attacker to perform actions as a logged-in administrator by inducing the admin to visit a malicious link or site. The CSNC a...

[ MDVSA-2013:235 ] mediawiki

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:235 http://www.mandriva.com/en/support/security/ Package : mediawiki Date : September 16, 2013 Affected: Business Server 1.0 Problem Description: Multiple vulnerabilities has been discovered and corrected in...

MGASA-2013-0276 Updated mediawiki package fixes security vulnerabilities

Full path disclosure in MediaWiki before 1.20.7, when an invalid language is specified in ResourceLoader CVE-2013-4301. Several API modules in MediaWiki before 1.20.7 allowed anti-CSRF tokens to be accessed via JSONP CVE-2013-4302. An issue with the MediaWiki API in MediaWiki before 1.20.7 where ...

Debian Security Advisory DSA 2753-1 (mediawiki - information leak)

It was discovered that in Mediawiki, a wiki engine, several API modules allowed anti-CSRF tokens to be accessed via JSONP. These tokens protect against cross site request forgeries and are confidential. OpenVAS Vulnerability Test $Id: deb2753.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generat...

[WATOBO 0.9.13] THE Web Application Toolbox

WATOBO is intended to enable security professionals to perform highly efficient semi-automated web application security audits. WATOBO works like a local proxy, similar to Webscarab, Paros or BurpSuite. Additionally, WATOBO supports passive and active checks. Passive checks are more like filter...

Google Translate Cross Site Request Forgery

+------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Google Translate CSRF Vulnerability Date : 06/20/2013 Author : Ivano Binetti http://www.ivanobinetti.com Affected Web site :...

[PySQLi] Python SQL injection framework

PySQLi is a python framework designed to exploit complex SQL injection vulnerabilities. It provides dedicated bricks that can be used to build advanced exploits or easily extended/improved to fit the case. PySQLi is thought to be easily modified and extended through derivated classes and to be ab...

AzDGDatingMedium 1.9.3 XSS / CSRF / SQL Injection / Directory Traversal

================================================= Vulnerable Software: AzDGDatingMedium Version 1.9.3 Official Site: http://www.azdg.com/ ================================================= ================================================= Tested: php.ini MAGICQUOTESGPC OFF Safe mode off / OS:...

Axous 1.1.1 multiple defects (CSRF-persistent XSS)-a vulnerability warning-the black bar safety net

Title: Axous 1.1.1 Multiple Vulnerabilities CSRF - Persistent XSS Author: Ivano Binetti http://www.ivanobinetti.com Software download: http://www.axous.com/get.php?pid=1 App developer website: http://www.axous.com/ Affects versions : 1.1.1 and lower Test system : Debian Squeeze 6.0...

Axous 1.1.1 - Cross-Site Request Forgery / Persistent Cross-Site Scripting

+-----------------------------------------------------------------------------------------------------------+ Exploit Title : Axous 1.1.1 Multiple Vulnerabilities CSRF - Persistent XSS Date : 30-04-2012 Author : Ivano Binetti http://www.ivanobinetti.com Software link :...

Axous 1.1.1 Multiple Vulnerabilities (CSRF - Persistent XSS)

Exploit for php platform in category web applications +---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Axous 1.1.1 Multiple Vulnerabilities CSRF - Persistent XSS Date : 30-04-2012...

WordPress Anti-CSRF令牌安全绕过漏洞

Bugtraq ID: 53280 CVE ID：CVE-2012-1936 WordPress是一款使用PHP语言开发的内容管理系统。 WordPress anti-CSRF令牌安全特性存在设计错误，攻击者可以利用漏洞绕过安全限制，执行跨站请求伪造攻击。 由于anti-CSRF令牌wpnonce, wpnoncecreate-user, ajaxnonce, wpnonce-custom-background-upload,...

WordPress 3.3.1 - Multiple Cross-Site Request Forgery Vulnerabilities

WordPress 3.3.1 - Multiple Cross-Site Request Forgery Vulnerabilities +---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Wordpress 3.3.1 Multiple CSRF Vulnerabilities Date : 19-03-20...

WordPress 3.3.1 - Multiple CSRF Vulnerabilities

WordPress version 3.3.1 is prone to a multiple cross site request forgery vulnerabilities. These vulnerabilities are caused by a security flaw in anti-CSRF token wpnonce, wpnoncecreate-user, ajaxnonce, wpnonce-custom-background-upload, wpnonce-custom-header-upload generation. Multiple CSRF allow ...

WordPress 3.3.1 Cross Site Request Forgery

+---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Wordpress 3.3.1 Multiple CSRF Vulnerabilities Date : 19-03-2012 Author : Ivano Binetti http://www.ivanobinetti.com Software link :...

SMF 2.0 / 1.1.14 XSRF Filter Bypass

Summary The img BBCode tag anti-CSRF filter can be bypassed due to incorrect parsing of the 'action' variable; because of this it is possible to successfully execute CSRF. Description Software: Simple Machines Forum SMF Versions: SMF 2.0 / SMF 1.1.14 Publication date: 2011-08-23 Impact: Cross Sit...