CVE-2015-8379

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the method parameter...

PT-2016-3898

Name of the Vulnerable Software and Affected Versions CakePHP versions 2.x through 3.1.4 Description The issue allows remote attackers to bypass the CSRF protection mechanism. This is achieved via the method parameter. Recommendations For CakePHP versions 2.x through 3.1.4, update to version 3.1....

PT-2017-7453

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.23.12 MediaWiki versions 1.24.x prior to 1.24.5 Description The issue allows remote attackers to bypass CSRF protection via a timing attack. This is due to the User::matchEditToken function not performing token...

CVE-2015-7364

The HTMLQuickform library, as used in Revive Adserver before 3.2.2, allows remote attackers to bypass the CSRF protection mechanism via an empty token...

PT-2015-7527

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue allows remote attackers to bypass the CSRF protection mechanism via an empty token. This is related to the HTML Quickform library used in Revive Adserver. Recommendations For versio...

CVE-2015-6728

The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack...

PT-2015-7318

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.23.10 MediaWiki versions 1.24.x prior to 1.24.3 MediaWiki versions 1.25.x prior to 1.25.2 Description The issue concerns the ApiBase::getWatchlistUser function, which does not perform token comparison in constant...

Gratipay: [gratipay.com] CRLF Injection

CRLF Injection Chrome, Internet Explorer http://gratipay.com/%0dSet-Cookie:csrftoken=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx; HTTP Response: Location: https://gratipay.com/\r Set-Cookie:csrftoken=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;\r\n CSRF Protection Bypass via CRLF Injection PoC: html This vulnerability...

CVE-2015-3658: Undefined Security Weakness

The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to...

PT-2015-6257

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 6.2.7 Apple Safari versions 7.x prior to 7.1.7 Apple Safari versions 8.x prior to 8.0.7 Description The issue arises from the Page Loading functionality in WebKit, which does not properly handle redirects when...

WS-2015-0069

In “exponentcms/exponent-cms”, v2.0.0 to v2.3.3 are vulnerable to Clickjacking. An attacker can bypass the referrer based CSRF protection...

CVE-2014-7809

Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable values, which allows remote attackers to bypass the CSRF protection mechanism...

PT-2014-8728

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.2.15 Description The issue allows remote attackers to bypass the cross-site request forgery CSRF protection mechanism. This can be achieved by either omitting the CSRF token or by using a long string in the...

CVE-2014-5205

wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack...

PT-2014-6343

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.9.2 Description The issue allows remote attackers to bypass a CSRF protection mechanism via a brute-force attack. This is due to the different timing of rejecting invalid CSRF nonces depending on which characters ...

PT-2014-6344

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.9.2 Description The issue concerns a weakness in the CSRF token generation mechanism. Specifically, it does not properly use delimiters during the concatenation of action values and uid values, making it easier fo...

ownCloud 6.0.0a - Multiple Vulnerabilities

No description provided by source. Exploit Title: ownCloud 6.0.0a File Deletion XSS and CSRF Protection Bypass Vendor Homepage: www.ownCloud.org OwnCloud Version: 6.0.0a Browsers tested: Iceweasel 22.0; Internet Explorer 11; Server: Debian. Default LAMP set-up. Exploit Author: James Sibley absane...

X (Formerly Twitter): [mobile.twitter.com / twitter.com] CSRF protection bypass

I shall explain all the steps to create the final PoC in order to be more clear. Part 1. Cookie Injection via Google Analytics 1 Google Analytics sets the cookie to track user source: 123456.123456789.11.2.utmcsr=HOST|utmccn=referral|utmcmd=referral|utmcct=PATH For example:...

CVE-2014-0473

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users...

CVE-2014-0473: Undefined Security Weakness

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users...