Ubiquiti Networks UniFi 3.2.10 - Cross-Site Request Forgery

Ubiquiti Networks UniFi 3.2.10 - Cross-Site Request Forgery RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ----------------------- Product: Ubiquiti Networks UniFi Vendor URL: www.ubnt.com Type: Cross-Site Request Forgery CWE-353 Date found: 2015-03-19 Date published:...

Ubiquiti Networks UniFi 3.2.10 - Cross-Site Request Forgery

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ----------------------- Product: Ubiquiti Networks UniFi Vendor URL: www.ubnt.com Type: Cross-Site Request Forgery CWE-353 Date found: 2015-03-19 Date published: 2016-02-23 CVSSv3 Score: 6.3...

DirectAdmin 1.491 - Cross-Site Request Forgery

DirectAdmin 1.491 - Cross-Site Request Forgery ============================================================================= Title : DirectAdmin 1.491 CSRF Vulnerability Date : 27-10-2014 updated 18-02-2016 Version : =1.491 Author : Necmettin COSKUN =@babayarisi Blog :http://ha.cker.io Vendor...

DirectAdmin 1.491 - Cross-Site Request Forgery

Exploit for php platform in category web applications ============================================================================= Title : DirectAdmin 1.491 CSRF Vulnerability Date : 27-10-2014 updated 18-02-2016 Version : =1.491 Author : Necmettin COSKUN =@babayarisi Blog :http://ha.cker.io...

DirectAdmin 1.491 - Cross-Site Request Forgery

============================================================================= Title : DirectAdmin 1.491 CSRF Vulnerability Date : 27-10-2014 updated 18-02-2016 Version : =1.491 Author : Necmettin COSKUN =@babayarisi Blog :http://ha.cker.io Vendor : http://www.directadmin.com/ Download:...

JVN#47296923: Cybozu Office vulnerable to information disclosure

Cybozu Office contains an information disclosure vulnerability. Impact If a user views a malicious page while logged in, token used for cross-site request forgery CSRF protection may be disclosed. As a result, an attacker who obtains the CSRF token can perform further attacks. Solution Update the...

OpenDocMan 1.3.4 - Cross-Site Request Forgery

OpenDocMan 1.3.4 - Cross-Site Request Forgery Security Advisory - Curesec Research Team 1. Introduction Affected Product: Opendocman 1.3.4 Fixed in: 1.3.5 Fixed Version Link: http://www.opendocman.com/free-download/ Vendor Website: http://www.opendocman.com/ Vulnerability Type: CSRF Remote...

OpenDocMan 1.3.4 - Cross-Site Request Forgery

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Opendocman 1.3.4 Fixed in: 1.3.5 Fixed Version Link: http://www.opendocman.com/free-download/ Vendor Website: http://www.opendocman.com/ Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 11/21/2015...

ATutor 2.2 - Multiple Cross-Site Scripting Vulnerabilities

ATutor 2.2 - Multiple Cross-Site Scripting Vulnerabilities Security Advisory - Curesec Research Team 1. Introduction Affected Product: Atutor 2.2 Fixed in: partly in ATutor 2.2.1-RC1, complete in 2.2.1 Fixed Version Link: http://www.atutor.ca/atutor/download.php Vendor Website:...

CVE-2015-7538

Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors...

Cross site request forgery (csrf)

Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors...

CVE-2015-7538

CVE-2015-7538 affects Jenkins prior to 1.640 and OpenJenkins LTS prior to 1.625.2. The issue allows remote attackers to bypass the CSRF protection mechanism via unspecified vectors, enabling bypass of CSRF controls and enabling potentially unauthorized actions on behalf of an authenticated user. ...

Atutor 2.2 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Atutor 2.2 Fixed in: partly in ATutor 2.2.1-RC1, complete in 2.2.1 Fixed Version Link: http://www.atutor.ca/atutor/download.php Vendor Website: http://www.atutor.ca/ Vulnerability Type: XSS Remote Exploitable: Yes Reporte...

Mail.ru: [touch.lady.mail.ru] CRLF Injection

PoC: https://touch.lady.mail.ru/%0aSet-Cookie:csrftoken=x;domain=.mail.ru; HTTP Response: HTTP/1.1 301 Moved Permanently ... Location: https://lady.mail.ru/ Set-Cookie:csrftoken=x;domain=.mail.ru; Уязвимость может быть использована для обхода CSRF защиты Django сайтов или для эксплуатации XSS чер...

Ipswitch MOVEit Mobile 1.2.0.962 Cross Site Request Forgery

Profundis Labs - Security Advisory Vulnerablity Title ================== MOVEit Filetransfer Cross Site Request Forgery Vulnerability CVE-2015-7678 Vendor: ======= Ipswitch, Inc http://www.ipswitchft.com Product: ======== MOVEit File Transfer MOVEit is an automated file transfer system that lets...

CVE-2015-8379

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the method parameter...

Cross site request forgery (csrf)

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the method parameter...

CVE-2015-8379

Removed by vendor...

phpDolphin 2.0.5 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: phpDolphin http://target.com/index.php?a=search&q=teste&filter=m"XSS CSRF ==== We've found no protection against CSRF Cross-site Request Forgery, which made possible to do any kind of act on a user or admin account. NO FORMS are...

KODExplorer 3.21 Cross Site Request Forgery

================================================================================ KODExplorer web file manager - Cross Site Request Foreign ================================================================================ Vendor Homepage: https://github.com/kalcaddle/KODExplorer/ -...