CVE-2016-6635

CVE-2016-6635 affects WordPress core: the CSRF flaw is in wp_ajax_wp_compression_test (wp-admin/includes/ajax-actions.php) in WordPress before 4.5, enabling remote attackers to hijack administrator sessions and change the script compression option. Affected: WordPress prior to 4.5. Impact: admin-...

New Relic: CSRF vulnerability that allows an attacker to purge plugin metric data

Vulnerability details A seemingly minor CSRF vulnerability exists in the endpoint that purges plugin metric data. When an admin visits the Agent overview of its account, it will show a button for each plugin that allows the admin to purge the data. This button links to a GET requests that is...

Open Upload Remote Cross-Site Request Forgery Vulnerability

Open Upload is an extensible PHP open source project for creating a private/public file download server . The Open Upload application suffers from a CSRF vulnerability, which can be exploited to lure an administrator user to a specially crafted URL via spear phishing or social engineering, allowi...

Typesettercms v5.0.1 - (Delete Files) CSRF Vulnerability

Document Title: =============== Typesettercms v5.0.1 - Delete Files CSRF Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1889 Release Date: ============= 2016-08-02 Vulnerability Laboratory ID VL-ID: ==================================== 188...

PayPal Fixes CSRF Vulnerability in PayPal.me

PayPal recently fixed a vulnerability on its PayPal.me site that could have let an attacker change a user’s profile without permission. The issue stemmed from a cross-site request forgery CSRF vulnerability that existed in PayPal.me, a site the company launched last year to let its users request...

NetApp Snap Creator Framework Cross-Site Request Forgery Vulnerability

NetApp Snap Creator Framework is the United States NetApp company's set of integrated NetApp functionality plug-ins and popular third-party applications framework. A cross-site request forgery vulnerability exists in versions of NetApp Snap Creator Framework prior to 4.3.P1, which can be exploite...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrar...

CVE-2016-2889

Cross-site request forgery CSRF vulnerability in the Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrar...

WordPress Lazy Content Slider 3.4 Cross Site Request Forgery

Exploit Title : WordPress Lazy content Slider Plugin - CSRF Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : https://wordpress.org/support/view/plugin-reviews/lazy-content-slider Category: Webapps Tested on: Win Version: 3.4 Date: 2016/07/08 PoC: The vulnerable page is...

WordPress Plugin Lazy Content Slider 3.4 - Cross-Site Request Forgery (Add Catetory)

Exploit Title : WordPress Lazy content Slider Plugin - CSRF Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : https://wordpress.org/support/view/plugin-reviews/lazy-content-slider Category: Webapps Tested on: Win Version: 3.4 Date: 2016/07/08 PoC: The vulnerable page is...

Fortinet FortiWeb CSRF Vulnerability (FG-IR-16-010)

Fortinet FortiWeb is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-1228

Cross-site request forgery CSRF vulnerability on NTT EAST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1006 and earlier and NTT WEST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1005 and earlier allows remote attackers to hijack the...

CVE-2016-2082

CVE-2016-2082 affects VMware vRealize Log Insight 2.x and 3.x prior to 3.3.2. The issue is a cross-site request forgery (CSRF/XSRF) vulnerability that can hijack an authenticated user’s session. The root cause is insufficient CSRF protection for certain actions. A remediation present in the conne...

Siemens Patches Password Reconstruction Vulnerability in SICAM PAS

The Industrial Control Systems Cyber Emergency Response Team ICS-CERT cautioned users who work in electrical substations to update certain builds of energy automation software this week. ICS-CERT claims two vulnerabilities exist in the Siemens SICAM Power Automation System, or PAS, that could...

CVE-2016-2901

Cross-site request forgery CSRF vulnerability in the PAThemeCreator application in IBM WebSphere Portal 8.5 CF08 through CF10 and Web Content Manager allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Yona CMS 1.3.x Cross Site Request Forgery

Exploit Title: Yona CMS document.forms0.submit;...

Airia - Cross-Site Request Forgery (Add Content)

Exploit for php platform in category web applications document.forms.csrfpoc.submit; 0day.today 2018-02-19...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on I-O DATA DEVICE ETX-R devices allows remote attackers to hijack the authentication of arbitrary users...

SlimCMS 0.1 - Cross-Site Request Forgery (Change Admin Password)

SlimCMS 0.1 - Cross-Site Request Forgery Change Admin Password input type="hidden" name="theme" value=...

Uber: Newsroom.uber HTML form without CSRF protection

Hi, The link that exists CSRF vulnerability https://newsroom.uber.com/india/how-to-refer/ Attack details Form name: Empty Form action: https://newsroom.uber.com/india/wp-login.php?action=postpass&wpe-login=ubernewblog Form method: POST Reproduction Steps 1-Create a file named submit.html 2-Write...