Facebook BBP - Session ID & CSRF Vulnerability

Document Title: =============== Facebook BBP - Session ID & CSRF Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1433 Video: https://www.youtube.com/watch?v=SAr2AGLrBkQ Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1432 Vulnerability Magazin...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php...

蝉知企业门户系统 v3.3csrf修改管理员密码

简要描述： 蝉知企业门户系统 v3.3csrf修改管理员密码 详细说明： 蝉知企业门户系统 v3.3最新版本 存在csrf漏洞 而且我测试的时候发现，即使修改了密码，管理员也不会马上需要重新登陆，所以配合我的回旋镖，可以达到神不知鬼不觉的修改其管理密码 接下来，我就来详细的演示漏洞过程 漏洞证明： 1、我们进入后台，发现没有添加管理员，那么我们来尝试一下修改管理员密码 很有意思，我们发现修改管理员的密码，不需要验证原密码好危险撒！ 那我们再来抓包截断看看有没有token之类的验证 2、用burpsuite截断 我的小伙伴们都惊呆了 有木有？？ 没有验证，就两个password...

World's largest domain name provider GoDaddy the presence of cross-site request forgery（CSRF）vulnerability-vulnerability warning-the black bar safety net

! Security engineer Dylan Saccomanni recently in GoDaddy domain management console is found on a cross-site request forgery（CSRF）vulnerability, an attacker exploit the vulnerability can control the user in the GoDaddy registered domain name. Godaddy is the world's largest domain name provider,wit...

GoDaddy Vulnerability Allows Domain Hijacking

An Internet domain registrar and web hosting company GoDaddy has patched a Cross-Site Request Forgery CSRF or XSRF vulnerability that allowed hackers and malicious actors to hijack websites registered with the domain registration company. The vulnerability was reported to GoDaddy on Saturday by...

CSRF Vulnerability Patched in GoDaddy Domain Settings

Domain registrar GoDaddy yesterday patched a cross-site request forgery vulnerability that could have allowed an attacker to change domain settings on a site registered with GoDaddy. The flaw was reported on Saturday and patched within 48 hours, according to Dylan Saccomanni, a web application...

CVE-2014-9510

Cross-site request forgery CSRF vulnerability in the administration console in TP-Link TL-WR840N V1 router with firmware before 3.13.27 build 141120 allows remote attackers to hijack the authentication of administrators for requests that change router settings via a configuration file import...

CVE-2015-0920

CVE-2015-0920 affects the Banner Effect Header WordPress plugin (version 1.2.6). A CSRF vulnerability allows remote attackers to hijack administrator authentication to trigger XSS via the banner_effect_email parameter on the BannerEffectOptions page (wp-admin/options-general.php). The issue is ex...

CVE-2014-4636

EMC Documentum Web Development Kit (WDK) prior to version 6.8 is affected by a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2014-4636). The issue allows an attacker to trick authenticated users into performing Docbase operations with their privileges by visiting a malicious link or page, ...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Our Team Showcase our-team-enhanced plugin before 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site...

CVE-2014-2598

The CVE-2014-2598 entry documents a CSRF/XSS vulnerability in the WordPress plugin Quick Page/Post Redirect Plugin (affected versions: before 5.0.5). The issue arises from handling of the quickppr_redirects[request][] parameter on the redirect-updates admin page (wp-admin/admin.php), enabling an ...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct cross-site scripting XSS attacks via th...

CVE-2014-9459

Summary of CVE-2014-9459 (e107 CMS) : A CSRF vulnerability in the AdminObserver function of e107(2.0 alpha2) affects e107_admin/users.php, allowing a remote attacker to hijack administrator authentication by tricking a logged-in admin into performing an action that adds a user to the administrato...

CVE-2011-5315

Cross-site request forgery CSRF vulnerability in admin/index.php in whCMS 0.115 alpha allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

CVE-2011-5284

CVE-2011-5284 describes a Cross-site Request Forgery vulnerability in Smoothwall Express 3.1 and 3.0 SP3 and earlier, specifically in the web management interface’s httpd/cgi-bin/shutdown.cgi. The vulnerability allows an attacker to hijack an administrator’s authenticated session to perform reboo...

CVE-2014-6168

Cross-site request forgery CSRF vulnerability in IBM Security Identity Manager 5.1 before 5.1.0.15 IF0056 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a saveuser action...

e107 2.0 Alpha2 Cross Site Request Forgery

Advisory: CSRF vulnerability in CMS e107 v.2 alpha2 Advisory ID: SROEADV-2014-04 Author: Steffen Rösemann Affected Software: CMS e107 v.2 alpha2 Release-Date: 08th-Jun-2014 Vendor URL: http://e107.org Vendor Status: solved CVE-ID: - ========================== Vulnerability Description:...

CVE-2012-1203

The CVE-2012-1203 entry describes a CSRF vulnerability in SyndeoCMS (starnet/index.php) affecting version 3.0 and earlier. The underlying issue is CSRF that allows remote attackers to hijack an administrator’s session to perform add-user actions via a save_user request. Affected component/file: s...

CVE-2014-5217

Cross-site request forgery CSRF vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword...