1855 matches found
Multiple Vulnerabilities in phpMyBackupPro
phpMyBackupPro is a professional MySql backup tool. A remote command execution and cross-site request forgery vulnerability exists in phpMyBackupPro 2.5. phpMyBackupPro uses a php configuration file globalconf.php to manage the settings, allowing the user to change the sql host, emails, etc. The...
No Password Required! 135 Million Modems Open to Remote Factory Reset
More than 135 Million modems around the world are vulnerable to a flaw that can be exploited remotely to knock them offline by cutting off the Internet access. The simple and easily exploitable vulnerability has been uncovered in one of the most popular and widely-used cable modem, the Arris...
LocalTapiola: The PdfServlet-functionality used by the "Tee vakuutustodistus" allows injection of custom PDF-content via CSRF-attack
Issue The reporter found an issue when the user creates a "Vakuutustodistus". The last page of the functionality shows a button "Lataa vakuutustodistus omalle koneellesi tulostusta varten." and contains a hidden form input-field "encodedPdfContent". By changing the "encodedPdfContent"-content, a...
Bumble: [CRITICAL] Full account takeover using CSRF
Hi , I have found a CSRF issue that allows an attacker to link his gmail , facebook ... or any social account to the victim's account and hijack the whole account. Details: When a user tries to link a gmail account with his account , after he authorizes badoo to use his gmail account he will be...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability on ReadyNet WRT300N-DD devices with firmware 1.0.26 allows remote attackers to hijack the authentication of arbitrary users...
X (Formerly Twitter): URGENT : NICHE.co Account Take Over Vulnerability
Hello ! This is an urgent report that you should immediately take care of !! I found out an account take over vulnerability on your acquisition : niche.co Proof of concept code CSRF Attack Page: /get-started/complete s The authenticitytoken parameter is not properly validated by the end of the...
HooToo Tripmate HT-TM01 Cross Site Request Forgery
Exploit Title: HooToo Tripmate HT-TM01 Cross Site Request Forgery Date: 03Sep15 Exploit Author: Ken Smith Contact: https://twitter.com/P4tchw0rk Vendor Homepage: http://www.hootoo.com Version: HT-TM01, version 2.000.022 1. Description Various functions in the device's admin web portal are...
WordPress Private Only 3.5.1 CSRF / Cross Site Scripting Vulnerabilities
Exploit for php platform in category web applications Details ================ Software: Private Only Version: 3.5.1 Homepage: http://wordpress.org/plugins/private-only/ Advisory report:...
WordPress SQL injection vulnerability and provide the right analysis-vulnerability warning-the black bar safety net
2313258f75eee9e3bf398ed6d1f0bb17 Reading: 2 7 5 WordPress core functionalitySQL injectionvulnerability analysis Threat Response Fellow at the center for the Wordpress core functionalitySQL injectionvulnerabilities number of CVE-2 0 1 5-5 6 2 3 and CVE-2 0 1 5-2 2 1 3for a detailed analysis 0x00...
Cisco Prime Infrastructure Web Interface Cross-Site Request Forgery Vulnerability
A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this...
SEC Consult SA-20150805-0 :: Websense Content Gateway Stack Buffer Overflow in handle_debug_network
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20150805-0 ======================================================================= title: Stack buffer overflow in handledebugnetwork product: Websense Triton Content Manager vulnerable version: 8.0.0...
Websense Triton Content Manager 8.0.0 Build 1165 Buffer Overflow
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Stack buffer overflow in handledebugnetwork product: Websense Triton Content Manager vulnerable version: 8.0.0 build 1165...
WordPress Google Plus One Button By KMS 1.5.0 CSRF / XSS
Title: WordPress 'Google 'Plus one' Button by kms' Plugin Version: 1.5.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: - https://wordpress.org/plugins/google-plus-one-button-by-kms/ - https://plugins.svn.wordpress.org/google-plus-one-button-by-kms/ Notified...
PT-2015-6493 · Cisco · Cisco Unified Intelligence Center
Name of the Vulnerable Software and Affected Versions: Cisco Unified Intelligence Center versions 10.01 through 10.61 Description: A cross-site request forgery CSRF issue in the web framework allows remote attackers to hijack the authentication of arbitrary users. Recommendations: For versions...
Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability
A vulnerability in the web framework of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit th...
ManageEngine EventLog Analyzer Cross Site Request Forgery
A cross site request forgery vulnerability exists in ManageEngine EventLog Analyzer. The vulnerability is due to insufficient input validation of parameters sent to event/userManagementForm.do. By convincing a user to follow a malicious link, a remote attacker can exploit this vulnerability to...
Resource Data Management Privilege Escalation Vulnerability
OVERVIEW Independent researcher Maxim Rupp has identified two vulnerabilities in Resource Data Management’s Data Manager application. Resource Data Management has produced a new version to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS Resourc...
CVE-2015-3191 - CSRF attack on change email | Cloud Foundry
CVE-2015-3191 – CSRF attack on change email Low Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v210 UAA versions prior to 2.3.0 Description The changeemail form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user...
ClickHeat 1.14 - Cross-Site Request Forgery (Change Admin Password)
ClickHeat 1.14 - Cross-Site Request Forgery Change Admin Password Exploit Title: ClickHeat input type="hidden" name="config" value="a:23:s:7:"logPath";s:31:"C:/xampp /htdocs/clickheat/logs/";s:9:"cachePath";s:32:"C:/xampp/htdocs/clickheat...