PT-2017-12429 · Cisco · Cisco Unified Intelligence Center

Name of the Vulnerable Software and Affected Versions: Cisco Unified Intelligence Center affected versions not specified Description: A lack of cross-site request forgery CSRF protection in the Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to execute unwanted...

ZKTeco ZKTime Web 2.0.1.12280 Cross Site Request Forgery

Vulnerability Type: Cross Site Request Forgery CSRF Vendor of Product: ZKTeco Affected Product Code Base: ZKTime Web - 2.0.1.12280 Affected Component: ZK Time Web Interface Management. Attack Type: Local - Authenticated Impact: Escalation of Privileges ------------------------------------------...

DEBIAN-CVE-2017-1002150

python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection...

CVE-2017-1002150

python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection...

CVE-2017-1002150

python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection...

Open redirect

python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection...

CVE-2017-1002150

python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection...

CVE-2017-1002150

CVE-2017-1002150 affects python-fedora ≤ 0.8.0. It is described as an open redirect vulnerability that results in loss of CSRF protection. The vulnerability is embedded in the python-fedora package and can impact Fedora-related tooling that uses this module. The provided connected documents confi...

CVE-2017-1002150

python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection...

See how I through subdomain takeover to bypass the Uber Single Sign-On authentication mechanism-vulnerability warning-the black bar safety net

! Uber to use the Amazon CloudFront CDN architecture website saostatic. uber. com there is a subdomain of the security vulnerability, an attacker take over. In addition, Uber recently deployed in the site auth. uber. com, based on Uber all the subdomain cookie sharing to achieve authentication of...

Cybozu Garoon 3.0.0 - 4.2.3 Multiple Vulnerabilities

Cybozu Garoon is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cybozu:garoon"; ifdescription...

U.S. Dept Of Defense: CRLF Injection on ███████

Summary: The web application hosted on the "█████" domain is affected by a carriage return line feeds CRLF injection vulnerability that could be used in combination with others. This issue could allow XSS via Cookie, bypass Double Submit Cookie csrf protection or Session Fixation on .█████████...

WakaTime: JSON CSRF on POST Heartbeats API

Thanks @sp1d3rs! WakaTime API used JSON for communications and supported cookie-based authentication/CSRF protection on https://api.wakatime.com. Usually, JSON is CSRF-safe, but only when requests with content-type other than application/json gets rejected or additional CSRF protection is in plac...

WakaTime: No rate limit when creating new goals [https://wakatime.com/goals]

Hi there, I was testing and found out that there's no rate limit on goals section https://wakatime.com/goals that means you can create multiple goals in a sec, which would lead to server crash since there's no limit per request that a user can make. I made at least 100 request, and still got 200 ...

CVE-2017-5244

Routes used to stop running Metasploit tasks either particular ones or all tasks allowed GET requests. Only POST requests should have been allowed, as the stop/stopall routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting...

Multiple Vulnerabilities in peplink balance routers

Multiple Vulnerabilities in peplink balance routers =================================================== Overview -------- Confirmed Affected Versions: 7.0.0-build1904 Confirmed Patched Versions: fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093.bin Vulnerable Firmware:...

Peplink Balance Routers Multiple Vulnerabilities

Peplink Balance routers are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:peplink:balance"; ...

Shopify: [out-of-scope] toxiproxy: Lack of CSRF protection allows an attacker to gain access to internal Shopify network

Disclaimer In case this report ever becomes public I wanted to start it out with a disclaimer so it doesn't become referenced an example for out-of-scope/policy violating submissions in the future: At the time of submission this report is out-of-scope and as such I have no expectations of reward...

Cisco Industrial Ethernet 1000 Series Switches Device Manager Cross-Site Request Forgery Vulnerability

A vulnerability in the Device Manager web interface of Cisco Industrial Ethernet 1000 Series Switches could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against a user of an affected system. The vulnerability is due to insufficient CSRF protection ...

Magento Vimeo Invalid Image Cross Site Request Forgery

A cross-site request forgery vulnerability exists in Magento. The vulnerability is due to insufficient CSRF protections, that enables an attacker to upload arbitrary files including PHP files to a target server. A remote attacker can exploit this vulnerability by enticing a target authenticated...