CVE-2013-2107

Cross-site request forgery CSRF vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdatemailto parameter in the mail-on-update pag...

PT-2014-5485 · D Link · D-Link Dap 1150

Name of the Vulnerable Software and Affected Versions: D-Link DAP 1150 version 1.2.94 Description: The issue allows remote attackers to hijack the authentication of administrators for various requests, including enabling or disabling the DMZ in the Firewall/DMZ section via a request to "index.cgi...

CVE-2013-2700

Vulnerability: CSRF in WP125 WordPress plugin (Add/Edit page adminmenus.php) affecting versions before 1.5.0. Attackers could hijack admin sessions to add/edit ads via unspecified vectors. Impact: unauthorized actions on admin-privileged functionality. Remediation: upgrade the WP125 plugin to ver...

CVE-2014-2989

Cross-site request forgery CSRF vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to Users/add...

CVE-2013-2692

OpenVPN Access Server before 1.8.5 is affected by a CSRF vulnerability in the Admin web interface that can allow an attacker to hijack the authentication of administrators and perform actions to create new administrative users. The issue is described as a cross-site request forgery affecting the ...

Сross-Site Request Forgery (CSRF) in TAO

Advisory ID: HTB23211 Product: TAO Vendor: Open Assessment Technologies S.A. Vulnerable Versions: 2.5.6 and probably prior Tested Version: 2.5.6 Advisory Publication: April 16, 2014 without technical details Vendor Notification: April 16, 2014 Public Disclosure: May 7, 2014 Vulnerability Type:...

CVE-2014-2190

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless aka BAC-TW allows remote attackers to hijack the authentication of arbitrary users for requests that make BAC-TW changes, aka Bug IDs CSCuo23804 and CSCuo26389...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the subscription page editor spageedit in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/...

MGASA-2014-0199 Updated bugzilla package fixes multiple vulnerabilities

Updated bugzilla packages fix security vulnerabilities: Cross-site request forgery CSRF vulnerability in processbug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that modify bugs via vectors involving a midair-collision tok...

CVE-2014-2186

Cross-site request forgery CSRF vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj81777...

Beetel 450TC2 Router Admin Password CSRF Vulnerability

Exploit for hardware platform in category web applications input type="hidden" name="uiViewToolsPasswordConfirm"...

Cloudflare: csrf on password change functionality

It was observed that the web application ‘www.cloudflare.com’ is vulnerable to cross site request forgery attacks via FORM field reconstruction. Risk : An attacker could force an already authenticated user to perform actions that he or she didn’t intend to do, such as account creation, Updating...

Teracom Modem T2-B-Gawv1.4U10Y-BI Cross Site Request Forgery

Exploit Title: Teracom Modem CSRF Vulnerability Date: 20-04-2014 Author: Rakesh S Software Link: http://www.teracom.in/ Version: T2-B-Gawv1.4U10Y-BI The vulnerability exists due to insufficient validation of HTTP request origin. A remote attacker can trick a logged-in administrator to visit a...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in TopAccess aka the web-based management utility on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords...

Cross site request forgery (csrf)

The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualifyfrequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service crash via a PJSIP endpoint that does not...

Microweber CMS 0.93 - CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Microweber CMS v0.93 CSRF Vulnerability Author: sajith version: Microweber CMS v0.93 Vendor Homepage: http://microweber.com/ vulnerable app link:http://microweber.com/download Application is vulnerable to CSRF.below is the POC...

Microweber CMS 0.93 - Cross-Site Request Forgery

Exploit Title: Microweber CMS v0.93 CSRF Vulnerability Author: sajith version: Microweber CMS v0.93 Vendor Homepage: http://microweber.com/ vulnerable app link:http://microweber.com/download Application is vulnerable to CSRF.below is the POC where attacker can use this vulnerability to create new...

IRCCloud: Full account takeover using CSRF and password reset

An attacker could take over any user account by doing the following things. 1 Exploit a CSRF vulnerability in /chat/user-settings. An attacker creates a webpage on a non-IRCCloud website for example: http://example.com/cat.html and inserts a hidden form like this: 2 The attacker will send a link ...

CVE-2013-2693

Cross-site request forgery CSRF vulnerability in the Options in the WP-Print plugin before 2.52 for WordPress allows remote attackers to hijack the authentication of administrators for requests that manipulate plugin settings via unspecified vectors...

Wordpress XCloner Plugin 3.1.0 - CSRF Vulnerability

Exploit for php platform in category web applications Product: XCloner Wordpress plugin Vendor: XCloner Vulnerable Versions: 3.1.0 and probably prior Tested Version: 3.1.0 Advisory Publication: March 12, 2014 without technical details Vendor Notification: March 12, 2014 Vendor Patch: March 13, 20...