CVE-2014-5217

Cross-site request forgery CSRF vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword...

W3TotalFail: W3 Total Cache v 0.9.4 CSRF Vulnerability that Leads to Full Deface

Title: W3TotalFail: W3 Total Cache v 0.9.4 CSRF Vulnerability that Leads to Full Deface Author: Mazin Ahmed Date of Discovering: October 6th, 2014 Date of Reporting to the Vendor: October 7th, 2014 Date of Releasing a Patch: December 9th, 2014 Vulnerability Type: Cross-Site Request Forgery CSRF -...

CVE-2014-9368

Affected software: WordPress twitterDash plugin, version 2.1 and earlier. Vulnerability: CSRF that allows remote attackers to hijack administrator authentication and trigger stored XSS via the username_twitterDash parameter in twitterDash.php directing requests to wp-admin/options-general.php. Im...

CVE-2014-6077

Cross-site request forgery CSRF vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Hidden in the Share button in the attack: Blogger. com exposure of high-risk CSRF（cross-site request forgery）vulnerability-vulnerability warning-the black bar safety net

The Egyptian security expert Mazen shows Gamal Mesbah on Blogger. com found a high risk of CSRF（cross-site request forgery）vulnerabilities. The vulnerability can allow an attacker in blogger without the knowledge of writing and publishing blogs, while the private blog public. Blogger is Google's...

CVE-2014-8246

Cross-site request forgery CSRF vulnerability in CA Release Automation formerly iTKO LISA Release Automation before 4.7.1 b448 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-8246

CA Release Automation (formerly iTKO LISA Release Automation) contains a CSRF vulnerability in CVE-2014-8246 affecting versions up to 4.7.1 Build 413; 4.7.1 Build 448 fixes the issue. The vulnerability allows a remote attacker to perform privileged actions by hijacking an authenticated session vi...

Cardoza Facebook Like Box < 2.8.3 - Multiple CSRF

The Easy Social Like Box – Popup – Sidebar Widget WordPress plugin was affected by a Multiple CSRF security vulnerability...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2014-9344

Cross-site request forgery CSRF vulnerability in Snowfox CMS before 1.0.10 allows remote attackers to hijack the authentication of administrators for requests that add a new admin account via a submit action in the admin/accounts/create uri to snowfox/...

Hacking PayPal Account with Just a Click

The eBay owned popular digital payment and money transfer service, PayPal has been found to be vulnerable to a critical web application vulnerability that could allow an attacker to take control over users' PayPal account with just a click, affecting more than 156 millions PayPal users. An Egypti...

CVE-2014-8429

CVE-2014-8429 describes a Cross-Site Request Forgery (CSRF) in xEpan CMS (versions 1.0.1 and earlier; affected 1.0.4.1, 1.0.4) where an attacker can hijack administrator sessions by convincing a logged-in admin to perform an action that creates a new administrative account via a crafted request t...

CVE-2014-4829

Cross-site request forgery CSRF vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allows remote attackers to hijack the authentication of arbitrary users for requests th...

CVE-2014-9033

Cross-site request forgery CSRF vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords...

wordpress -- multiple vulnerabilities

MITRE reports: wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message. wp-includes/http.php in WordPress before 3.7.5, 3.8...

phpyun csrf修改用户密码

简要描述： phpyun csrf修改用户密码 详细说明： 更新用户信息的请求没有防御csrf。可以修改用户的邮箱。而重置密码功能是选择用户信息中的邮箱发送找回验证码。结合利用。 修改用户信息的请求为:...

Snowfox CMS v1.0 CSRF Add Admin Exploit

Summary Snowfox is an open source Content Management System CMS that allows your website users to create and share content based on permission configurations. Description Snowfox CMS suffers from a cross-site request forgery vulnerabilities. The application allows users to perform certain actions...

Tenda A32 Router - CSRF Vulnerability

No description provided by source. Exploit Title: Tenda A32 Router CSRF Vulnerabilityreboot the Router CVE ID :CVE-2014-7281 Date: 2014-10-10 Exploit Author: zixian Vendor Homepage: http://tenda.com.cn/ Software Link: http://tenda.com.cn/Catalog/Product/325 Version: V5.07.53CN When the...

Cross site request forgery (csrf)

The Compal Broadband Networks CBN CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to cause a denial of service disconnect all wifi clients via a request to wirelessChannelStatus.html...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Axway SecureTransport 5.1 SP2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that upload arbitrary files via a crafted request to api/v1.0/files/...