9516 matches found
MySQL 5.6.x < 5.6.34 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)
The version of MySQL running on the remote host is 5.6.x prior to 5.6.34. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in s3srvr.c, sslsess.c, and t1lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An...
[ASA-201610-12] python2-django: cross-site request forgery
Arch Linux Security Advisory ASA-201610-12 ========================================== Severity: Medium Date : 2016-10-21 CVE-ID : CVE-2016-7401 Package : python2-django Type : cross-site request forgery Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package...
XSS Vulnerability in NetEase Mail Master Client Android Version
NetEase Mail Master client is a universal email client launched by NetEase 163. An XSS vulnerability exists in the Android version Ver4.14.1 of the NetEase Mail Master client. It allows attackers to insert malicious js code into the page to obtain user cookies and other information, leading to us...
XSS Vulnerability in NetEase Mail Client for Android
NetEase Mail Master client is a universal email client launched by NetEase 163. A cross-site scripting vulnerability exists in NetEase Mail Master Android Ver 4.13.3. It allows attackers to insert malicious js code into the page to obtain user cookies and other information, leading to user...
XSS Vulnerability in NetEase Mail Master Client IOS Version
NetEase Mail Master client is a universal email client launched by NetEase 163. An XSS vulnerability exists in the IOS version Ver4.14.1 of the NetEase Mail Master client. It allows attackers to insert malicious js code into the page to obtain user cookies and other information, leading to user...
21CN Email Client - Micro Mail IOS Version XSS Vulnerability
Micro Mail is a multi-mailbox management mobile client, mobile office tools for personal and business users. XSS vulnerability exists in the IOS version of 21CN Email Client - MicroMail, which allows attackers to insert malicious js code into the page to obtain user cookies and other information,...
Anchor CMS 0.12.1 Cross Site Scripting
======================================================================== | Title : Anchor cms 0.12.1 bundled XSS vulnerability | Author : indoushka | email : [email protected] | Tested on : windows 8.1 FranASSais V.Pro | Version : 5.2.0 | Vendor :...
Codoforum 3.4 Build 19 Cross Site Scripting
======================================================================== | Title : codoforum.v.3.4.build-19 XSS vulnerability | Author : indoushka | email : [email protected] | Tested on : windows 8.1 FranASSais V.Pro | Version : 5.2.0 | Vendor : http://codoforum.com/ | Dork : Powered by...
python-django: CSRF protection bypass on a site with Google Analytics
A CSRF flaw was found in Django, where an interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. In this update, the parser for ''request.COOKIES'' has been simplified to better match browser behavi...
python-django: CSRF protection bypass on a site with Google Analytics
A CSRF flaw was found in Django, where an interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. In this update, the parser for ''request.COOKIES'' has been simplified to better match browser behavi...
python-django: CSRF protection bypass on a site with Google Analytics
A CSRF flaw was found in Django, where an interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. In this update, the parser for ''request.COOKIES'' has been simplified to better match browser behavi...
Moderate: Red Hat Security Advisory: python-django security update
An update for python-django is now available for Red Hat OpenStack Platform 8.0 Liberty. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Wordpress <= 4.6.1 Triggers Stored XSS Vulnerability Using Theme Files
WordPress is a free and open source blogging software and content management system using PHP and MySQL as its platform. A backend stored XSS vulnerability can be exploited by uploading maliciously constructed theme files in Wordpress = version 4.6.1. A backend stored XSS vulnerability can be...
Simple PHP Blog 0.8.4 Cross Site Scripting
======================================================================== | Title : Simple PHP Blog 0.8.4 XSS vulnerability | Author : indoushka | email : [email protected] | Tested on : windows 8.1 FranASSais V.Pro | Version : 0.8.4 | Vendor : https://sourceforge.net/projects/sphpblog/ |...
Kure 0.7.1 Cross Site Scripting
======================================================================== | Title : kure-0.7.1 XSS vulnerability | Author : indoushka | email : [email protected] | Tested on : windows 8.1 FranASSais V.Pro | Version : 0.7.1 | Vendor :...
Gratipay: CSRF csrftoken in cookies
Hi, Your web application generates CSRF token values inside cookies which is not a best practice for web applications as revelation of cookies can reveal CSRF Tokens as well. Authenticity tokens should be kept separate from cookies and should be isolated to change operations in the account only...
PYSEC-2016-3
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies...
Cross site request forgery (csrf)
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies...
PYSEC-2016-3
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies...
