1717 matches found
Google Moves to Block CSRF Attacks
The Register’s Dan Goodin has news about a belated but significant move by Google to protect its GMail and other services from CSRF cross site request forgery attacks. In recent days, Google’s login pages began setting a cookie with a unique token on each user’s browser. That same value is also...
CVE-2008-7082
CVE-2008-7082 affects MyBB 1.4.3, where the sensitive my_post_key token is exposed in URLs to moderation.php for actions (mergeposts, split, deleteposts). An attacker can read the token from the HTTP Referer header to bypass CSRF protection and hijack a moderator’s session/authentication. The sou...
Directory traversal in Profile Picture path - leads to privilege escalation in < 3.0
Confluence allows its users to specify a "Profile Picture," an image that appears on many pages related to the user. A user can either upload a custom image, or select one from a set provided by Confluence. Confluence uses the /users/doeditmyprofilepicture.action path to process requests to chang...
Cross site scripting
Cross-site scripting XSS vulnerability in the redirect function in functions.php in MyBB aka MyBulletinBoard 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter in a removesubscriptions action to moderation.php, related to use of the ajax option to request a...
CVE-2008-4928
Cross-site scripting XSS vulnerability in the redirect function in functions.php in MyBB aka MyBulletinBoard 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter in a removesubscriptions action to moderation.php, related to use of the ajax option to request a...
cpanel-xssxsrf.txt
DESCRIPTION OF THE SOFTWARE cPanel is a hosting automation tool. WHM interface provides access to the heart of the cPanel and WHM package and allows a Server Administrator to simply configure a few options and be on their way to hosting web sites. 2. DESCRIPTION OF THE VULNERABILITY There are...
Referrer spoofing bug
Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection mechanisms that rely ...
Design/Logic Flaw
Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protecti...
CVE-2007-5960
Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protecti...
CVE-2007-5960
Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protecti...
CVE-2007-5828
Cross-site request forgery CSRF vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CS...
sBlog 0.7.3 Beta Cross Site Request Forgery
!-- - Product : sBlog - - Version : 0.7.3 Beta - - Website : http://www.sblog.se - - Author : 0x90 - - Homepage: WwW.0x90.CoM.Ar - - Contact : Gunsat0x90dotcomdotar - - Problem : Cross Site Request Forgery Vulnerability - - Sumary : sBlog has, by default, no CSRF protection, this may allow an...
DEBIAN-CVE-2007-0106
Cross-site scripting XSS vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when...
CVE-2007-0106
Cross-site scripting XSS vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when...
CVE-2007-0106
Cross-site scripting XSS vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when...
CVE-2007-0106
CVE-2007-0106 affects WordPress up to version 2.0.5 (before 2.0.6). The issue is a Cross-site Scripting (XSS) vulnerability in the CSRF protection scheme, where an attacker can inject arbitrary script/HTML via a CSRF attack using an invalid token and quote characters or HTML tags in URL variable ...
CVE-2007-0106
Cross-site scripting XSS vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when...