405 matches found
4 TOTOLINK Router Models - CSRF and XSS Vulnerabilities
4 TOTOLINK router models suffer from cross site request forgery and cross site scripting vulnerabilities. Advisory Information Title: 4 TOTOLINK router models vulnerable to CSRF and XSS attacks Advisory URL: https://pierrekim.github.io/advisories/2015-totolink-0x01.txt Blog URL:...
DigitalSellz: The product/status method CSRF
When we use the "on/off" buttons to set the products to be shown on the products page, a POST-request to https://www.digitalsellz.com/product/status is sent with only the product id as a parameter no other security tokens. So the idea is to make my rival visit a web page with a code like this:...
ipTIME n104r3 Cross Site Request Forgery / Cross Site Scripting
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory Information Title: iptime n104r3 vulnerable to CSRF and XSS attacks Advisory URL: https://pierrekim.github.io/advisories/2015-iptime-0x01.txt Blog URL:...
Concrete CMS: Multiple Cross Site Request Forgery Vulnerabilities in Concrete5 version 5.7.3.1
Concrete5 implements a Synchronizer Token Pattern in order to provide anti-CSRF capabilities, which is done within the Concrete\Core\Validation\CSRF\Token class. However, the application fails to properly use this feature in every block or dashboard page which makes a system state change, such as...
Vimeo: CSRF bypass
Dear Team, Once again i'm here. During research of vimeo.com I found that you are using anti-csrf token against csrf attack. but it's not going to validate on server side. let's see Step 1: go to https://vimeo.com/forgotpassword Step 2: write your email and click on help me. Step 3: Now before...
W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery (CSRF)
The plugin does not validate the 'wpnonce' anti-CSRF token. This issue can be used to perform many actions. The most significant action with the biggest impact is the ability to redirect users to malicious websites. Functionality exists where specific user agent strings can be configured to be...
Axway Secure Transport 5.1 SP2 - Arbitary File Upload via CSRF
No description provided by source. !-- Exploit Title: Axway Secure Transport 5.1 SP2 Arbitary File Upload via CSRF Exploit author: Emmanuel Law Public Disclosure Date : 20/10/14 Vendor homepage: http://www.axway.com Affected Software version: Axway Secure Transport 5.2.1 SP2 and possibly earlier...
Axway Secure Transport 5.1 SP2 - Arbitary File Upload via CSRF
Exploit for php platform in category web applications function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://sftp.example.org/api/v1.0/files/", true; xhr.setRequestHeader"Accept", "...
Axway Secure Transport 5.1 SP2 - Arbitrary File Upload (via Cross-Site Request Forgery)
function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://sftp.example.org/api/v1.0/files/", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8"; xhr.setRequestHeader...
Netsparker v3.5 - Web Application Security Scanner
Netsparker Web Application Security Scanner can find and report web application vulnerabilities such as SQL Injection and Cross-site Scripting XSS and security issues on all web applications and websites regardless of the platform and the technology they are built on. Netsparker is very easy to u...
Ubee EVW3200 - Cross Site Request Forgery
No description provided by source. Exploit Title: Ubee EVW3200 - Multiple Cross Site Request Forgery Google Dork: N/A Date: 02-03-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.ubeeinteractive.com/ Software Link:...
Wordpress 3.3.1 - Multiple CSRF Vulnerabilities
No description provided by source. +---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Wordpress 3.3.1 Multiple CSRF Vulnerabilities Date : 19-03-2012 Author : Ivano Binetti...
Axous 1.1.1 - Multiple Vulnerabilities (CSRF - Persistent XSS)
No description provided by source. +-----------------------------------------------------------------------------------------------------------+ Exploit Title : Axous 1.1.1 Multiple Vulnerabilities CSRF - Persistent XSS Date : 30-04-2012 Author : Ivano Binetti http://www.ivanobinetti.com Software...
Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability
No description provided by source. ANATOLIA SECURITY ADVISORY -------------------------------------- ADVISORY INFO + Title: Apache Archiva Cross-site Request Forgery Vulnerability + Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-001.txt + Advisory ID: 2010-001 + Versions: Archiva 1...
Ubee EVW3200 Cross Site Request Forgery
Exploit Title: Ubee EVW3200 - Multiple Cross Site Request Forgery Google Dork: N/A Date: 02-03-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.ubeeinteractive.com/ Software Link: http://www.ubeeinteractive.com/products/cable?fieldproductcatetorytid=20 Version: All Tested on:...
Ubee EVW3200 - Cross Site Request Forgery Vulnerability
Ubee EVW3200 suffers from a cross site request forgery vulnerability. Exploit Title: Ubee EVW3200 - Multiple Cross Site Request Forgery Google Dork: N/A Date: 02-03-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.ubeeinteractive.com/ Software Link:...
Ubee EVW3200 - Cross-Site Request Forgery
Exploit Title: Ubee EVW3200 - Multiple Cross Site Request Forgery Google Dork: N/A Date: 02-03-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.ubeeinteractive.com/ Software Link: http://www.ubeeinteractive.com/products/cable?fieldproductcatetorytid=20 Version: All Tested on:...
Ubee EVW3200 - Cross-Site Request Forgery
Ubee EVW3200 - Cross-Site Request Forgery Exploit Title: Ubee EVW3200 - Multiple Cross Site Request Forgery Google Dork: N/A Date: 02-03-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.ubeeinteractive.com/ Software Link:...
Slack: State parameter missing on google OAuth
Hi, State parameter i.e anti-csrf token to prevent session hijacking attacks is missing on Google OAuth i.e...
Joomla! JomSocial component < 3.1.0.1 - Remote code execution
------------------------------------------------------------- Joomla! JomSocial component 3.1.0.1 - Remote code execution ------------------------------------------------------------- == Description == - Software link: http://www.jomsocial.com/ - Affected versions: All versions = 2.6 and 3.1.0.1...