MGASA-2016-0051 Updated phpmyadmin/phpseclib packages fix security vulnerability

Password suggestion functionality uses Math.random which does not provide cryptographically secure random numbers CVE-2016-1927. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full pa...

CVE-2015-7537

CVE-2015-7537 affects Jenkins, described as a CSRF vulnerability that could allow an attacker to hijack admin authentication via HTTP GET. Affected versions: Jenkins before 1.640 and LTS before 1.625.2. Mitigation: upgrade to Jenkins 1.640 or newer or LTS 1.625.2 or newer. The connected advisory ...

Shopify: CSRF on https://shopify.com/plus

Hello. To reproduce this CSRF, visit https://www.shopify.com/plus?insppingurln=https://example.com/%23 Will be sent this post request on example.com: POST https://example.com/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:44.0 Gecko/20100101 Firefox/44.0 Accept: application/jso...

Zomato: Twitter Disconnect CSRF

Hi Using this CSRF vulnerability one could disconnect Twitter account from their profiles. Vulnerable request GET /php/disconnecttwitterprofile.php HTTP/1.1 Host: www.zomato.com Connection: keep-alive Accept: text/html, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 Windows NT...

Manage Engine Network Configuration Manager Build 11000 - Cross-Site Request Forgery

Exploit for multiple platform in category web applications ========================================================================================= Cross-Site Request Forgery Vulnerability in ManageEngine Network Configuration Management...

ManageEngine Network Configuration Management Build 11000 CSRF

Title:- Cross-Site Request Forgery CSRF Vulnerability in ManageEngine Network Configuration Management Author: Kaustubh G. Padwad Vendor: ZOHO Corp Product: ManageEngine Network Configuration Manager Tested Version: : Network Configuration Manager Build 11000 Severity: HIGH About the Product:...

jenkins: CSRF vulnerability in some administrative actions (SECURITY-225)

Cross-site request forgery CSRF vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method...

pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery

pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://192.168.0.103/diagbackup.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8";...

CVE-2016-1134

The CVE-2016-1134 entry documents a Cross-site request forgery (CSRF) vulnerability affecting BUFFALO network devices (e.g., BHR-4GRV2, WEX-300, WHR-1166DHP, WHR-300HP2, WHR-600D, WMR-300, WMR-433, WSR-1166DHP) with specific firmware versions (e.g., 1.04 and earlier for BHR-4GRV2; 1.90 and earlie...

IBM WebSphere Application Server CSRF Vulnerability (Jan 2016)

IBM WebSphere Application Server is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

Shopify: Twitter Disconnect CSRF

Hello, Using this CSRF vulnerability one could disconnect twitter account from their profiles. Vulnerable request GET /auth/twitter/disconnect HTTP/1.1 Host: twitter-commerce.shopifyapps.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:43.0 Gecko/20100101 Firefox/43.0 Accept:...

CVE-2015-3946

CVE-2015-3946 (Advantech WebAccess) : A CSRF vulnerability exists in WebAccess prior to version 8.1 that can allow remote attackers to hijack user authentication. Affected product: Advantech WebAccess (HMI/SCADA software). Root cause: cross-site request forgery enabling unauthorized actions in au...

Coinbase: The 'Create a New Account' action is vulnerable to CSRF

The request to create an account wallet doesn't validate if the request is originating from the user itself with the help of an anti-CSRF token. Step 1: Craft an HTML page with request to create a wallet in your accounts page. https://www.coinbase.com/accounts New Account Wallet Step 2: Open the...

CVE-2015-7465

Cross-site request forgery CSRF vulnerability in Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2015-7284

CVE-2015-7284 describes a CSRF vulnerability in ZyXEL NBG-418N devices running firmware 1.00(AADZ.3)C0. An attacker can hijack the authentication of arbitrary users via forged requests, potentially executing actions with the victim’s session privileges. Documented impact includes remote attacker ...

CVE-2015-7281

The vulnerability CVE-2015-7281 affects ReadyNet WRT300N-DD devices running firmware 1.0.26. A CSRF flaw allows an attacker to hijack the authentication of arbitrary users, by exploiting requests made within a user’s session, effectively acting with the victim’s privileges. The CNVD entry for Rea...

XZERES 442SR Wind Turbine Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified a cross-site request forgery CSRF vulnerability in XZERES’s 442SR turbine generator operating system OS. XZERES has produced a patch that mitigates this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The...

WordPress Limit Attempts 1.0.3 Cross Site Request Forgery

Plugin Name : WP Limit Attempts A8-Cross-SiteRequestForgeryCSRF Effected Version : 1.0.3 and most probably lower version's if any Vulnerability : A8-Cross-Site Request Forgery CSRF Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Unauthenticated PoC - Proof of...

CVE-2015-8563

Cross-site request forgery CSRF vulnerability in the comtemplates component in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2015-6405

CVE-2015-6405 is a CSRF vulnerability in Cisco Emergency Responder (web framework) affecting version 10.5(1) and 10.5(1a). The issue arises from insufficient CSRF protection, allowing an unauthenticated, remote attacker to perform actions with a user’s privileges by tricking them into visiting a ...