WordPress Copy-Me 1.0.0 Cross Site Request Forgery

Details ================ Software: copy-me Version: 1.0.0 Homepage: http://wordpress.org/plugins/copy-me/ Advisory report: https://security.dxw.com/advisories/copy-me-vulnerable-to-csrf-allowing-unauthenticated-attacker-to-copy-posts/ CVE: Awaiting assignment CVSS: 4.3 Medium;...

CVE-2016-7454

CVE-2016-7454 affects Technicolor/Comms Cisco DPC3941T gateways (firmware dpc3941-P20-18-v303r20421733-160413a-CMCST). The vulnerability is a Cross-Site Request Forgery (CSRF) in the device’s admin interfaces that enables an attacker to change the Wi‑Fi password, open the remote management interf...

WordPress Plugin Quiz And Survey Master 4.5.4/4.7.8 - Cross-Site Request Forgery

alert1” in the questionname field then “question: ‘alert1’,” will get output inside the JS object. All good so far. However, in js/adminquestion.js on line 205, we see this line, as part of some JS-generated HTML: jQuery''.htmlquestionslisti.question.replace/"/g, '"'.replace/'/g,...

[SECURITY] [DLA 732-3] monit regression update

Package : monit Version : 1:5.4-2+deb7u3 Debian Bug : 847196 The update for monit issued as DLA-732-1 causes monit to segfault when using the collector function meant to provide data to M/Monit. This update fixes the regression. For reference the original advisory text follows. Adith Sudhakar...

Ruby on Rails: CSRF header is sent to external websites when using data-remote forms

Looks like there is a regression in the fix for CVE-2015-1840 H1 report. The origin isn't being checked before adding a CSRF header to data-remote forms. I noticed this when checking out the new rails-ujs repo. Example Rails template: submit Example http://attacker.com app require "sinatra" optio...

CVE-2016-2963

Cross-site request forgery CSRF vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the Connections generic page...

CVE-2016-2963

Cross-site request forgery CSRF vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

SOL21485342 - Configuration utility CSRF vulnerability

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SweetRice 1.5.1 Code Execution

Hacked '; phpinfo; Code You Can Customize Exploit For Your Self . Exploit : -- Hacked '; phpinfo;?...

SweetRice 1.5.1 - Cross-Site Request Forgery / PHP Code Execution Exploit

Exploit for php platform in category web applications Hacked '; phpinfo; Code You Can Customize Exploit For Your Self . Exploit : -- Hacked '; phpinfo;? 0day.today 2018-03-31...

Orange Inventel LiveBox 5.08.3-sp - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Orange Inventel LiveBox CSRF Google Dork: N/A Date: 10-24-2016 Exploit Author: BlackMamba TEAM BM1 Vendor Homepage: N/A Version: Inventel - v5.08.3-sp Tested on: Windows 7 64bit CVE : N/A Category: Hardware 1. Description...

CVE-2016-1000213

Ruckus Wireless H500 web management interface CSRF...

AVTECH video surveillance equipment authentication bypass and other vulnerabilities

Authentication bypass vulnerability There are two ways to achieve authentication bypass: The first one is. cab way, the cab file format is a video player plug-in, stored in the web root directory, it may need to verify directly be accessed and downloaded, and the device end only through the strst...

Starbucks: CSRF vulnerability in saving payment card on store.starbucks.com (COBilling -AddCreditCard)

Hi, I noticed a CSRF issue that associated with card saving. It is possible for to save card details and can be used for quick payments while purchasing. The result will be a remote attacker can trick users to use some other cards that may silently led to loss of money in which actully it is not...

ASUS RP-AC52 Access Point Cross-Site Request Forgery Vulnerability

The ASUS RP-AC52 Access Point is a wireless access point from ASUS. A cross-site request forgery vulnerability exists in the ASUS RP-AC52 Access Point using firmware version 1.0.1.1s. A remote attacker can exploit this vulnerability to modify settings and take full control of the system...

MGASA-2016-0343 Updated mailman package fixes security vulnerability

Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account...

Pluck 4.7.3 Delete Files Cross Site Request Forgery

i?Document Title: =============== Pluck 4.7.3 - Delete Files CSRF Vulnerability Release Date: ============= 2016-10-12 Vulnerability Disclosure Timeline: ================================== 2016-10-12 : Discovery of the Vulnerability 2016-10-12 : Contact the Vendor No Respose 2016-10-17 : Public...

PHP Press Release - Cross-Site Request Forgery (Add Admin)

Exploit Title : PHP Press Release - Cross-Site Request Forgery Add Admin - Super User Author : Besim Google Dork : - Date : 09/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.pagereactions.com/product.php?pku=1 Software link :...

Jaws CMS v1.1.1 - Privilege Escalate CSRF Vulnerability

Product & Service Introduction: =============================== Jaws is a Framework and Content Management System for building dynamic web sites. It aims to be User Friendly giving ease of use and lots of ways to customize web sites, but at the same time is Developer Friendly, it offers a simple...