chatNow - Multiple Vulnerabilities

chatNow - Multiple Vulnerabilities Exploit Title: chatNow - Multiple Vulnerabilities Date: 2016-08-23 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: http://chatnow.thiagosf.net/ Software Link: https://github.com/thiagosf/chatNow/archive/master.zip Version: Latest comm...

WSO2 Carbon 4.4.5 Cross Site Request Forgery / Denial Of Service

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-CSRF-DOS.txt + ISR: ApparitionSec Vendor: ============ www.wso2.com Product: ================== Ws02Carbon v4.4.5 WSO2 Carbon is the core platform on which...

Open Upload 0.4.2 - Cross-Site Request Forgery (Add Admin)

================================================================================================================ Open Upload 0.4.2 Remote Admin Add CSRF Exploit and Changing Normal user permission...

Harvest: Opportunity to set arbitrary cookies

The location hash on a configure page is used to set a cookie value of the same content. Visiting of a page like https://%domain%.harvestapp.com/invoices/configurefoo will result into a foo cookie setting. This value isn't validated at all, which gives an attacker the opportunity to set arbitrary...

Open Upload 0.4.2 - Multiple Cross-Site Request Forgery Vulnerabilities

Exploit for php platform in category web applications ================================================================================================================ Open Upload 0.4.2 Remote Admin Add CSRF Exploit and Changing Normal user permission...

Moodle 2.4.x < 2.4.8 / 2.5.x < 2.5.4 / 2.6.x < 2.6.1 Multiple Vulnerabilities

Binary data 9420.prm...

Moodle 2.8.x < 2.8.12 / 2.9.x < 2.9.6 / 3.0.x < 3.0.4 Multiple Vulnerabilities

Binary data 9427.prm...

CVE-2016-6209

A user supplied GET parameter is used to create the value used as the src value of an iframe displayed on all pages. It allows for CSRF and javascript insertion techniques among others. An attacker could forge a malicious URL that could include javascript execution in the main browser frame...

KMC Controls BAC-5051E Multiple Vulnerabilities

KMC Controls BAC-5051E is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-4319: /auditing/settings was vulnerable to CSRF

panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Cloud. Using JIRA Server? See the corresponding bug report|http://jira.atlassian.com/browse/JRASERVER-61803. panel The /auditing/settings resource was vulnerable to CSRF|https://en.wikipedia.org/wiki/Cross-siterequestforgery attacks...

MGASA-2016-0240 Updated phpmyadmin packages fix security vulnerability

In phpMyAdmin before 4.4.15.7, a vulnerability was discovered that allows a BBCode injection to setup script in case it's not accessed on https CVE-2016-5701. In phpMyAdmin before 4.4.15.7, a vulnerability was discovered that allows an SQL injection attack to run arbitrary commands as the control...

Cross site request forgery (csrf)

The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy CSP protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication toke...

Yona CMS 1.3.x Cross Site Request Forgery

Exploit Title: Yona CMS document.forms0.submit;...

Yona CMS - Cross-Site Request Forgery

Yona CMS - Cross-Site Request Forgery document.forms0.submit;...

Airia - Cross-Site Request Forgery (Add Content)

document.forms.csrfpoc.submit;...

Nextcloud: Lost Password CSRF

Hi, I think it is something about your Wordpress version.It's not something highy risky bu it is vulnerability. CODE: Username or Email For testing CSRF I added the .html file to attachments.And there is a screenshot for you. How To Fix : Adding rpkey will be fine. Please take a look at links bel...

Ultrabenosaurus ChatBoard - Cross-Site Request Forgery (Send Message)

form name="csrfpoc" action="http://127.0.0.1/vulte...

CVE-2015-5170-5173 UAA Vulnerabilities | Cloud Foundry

CVE-2015-5170-5173 UAA Vulnerabilities Low Vendor Cloud Foundry Foundation Versions Affected cf-release versions v215 & prior UAA versions 2.5.1 & prior Description CSRF Attack on PWS. It is possible to log the user into another account instead of the account they intended to log into because of...

EMC ViPR SRM - Cross-Site Request Forgery

Exploit for php platform in category web applications !-- EMC M&R Watch4net lacks Cross-Site Request Forgery protection Abstract It was discovered that EMC M&R Watch4net does not protect against Cross-Site Request Forgery CSRF attacks. A successful CSRF attack can compromise end user data and may...

EMC ViPR SRM - Cross-Site Request Forgery

!-- EMC M&R Watch4net lacks Cross-Site Request Forgery protection Abstract It was discovered that EMC M&R Watch4net does not protect against Cross-Site Request Forgery CSRF attacks. A successful CSRF attack can compromise end user data and may allow an attacker to perform an account hijack. If th...