A Forms 1.4.0 - Form Submission CSRF

The A Forms WordPress plugin was affected by a Form Submission CSRF security vulnerability...

Paid Business Listings - Blind SQL Injection

Form Submission pbllistingpkgid Parameter...

68kb Knowledge Base 1.0.0rc3 - Edit Main Settings CSRF

No description provided by source. Exploit Title: 68kb Knowledge Base v1.0.0rc3 edit main settings CSRF Date: 2010-04-02 Author: Jelmer de Hen Software Link: http://68kb.googlecode.com/files/68kb-v1.0.0rc3.zip Version: v1.0.0rc3 html body onload=document.forms'editsettings'.submit form...

WordPress MoodThingy Widget 0.8.7 - Blind SQL Injection

No description provided by source. Exploit Title: WordPress MoodThingy Mood Rating Widget v0.8.7 Blind SQL Injection Date: 7/2/12 Exploit Author: Chris Kellum Vendor Homepage: http://www.moodthingy.com/ Software Link: http://downloads.wordpress.org/plugin/moodthingy-mood-rating-widget.0.8.7.zip...

phpAutoVideo CSRF Vulnerability

No description provided by source. Exploit Title: phpAutoVideo csrf SoftWare:https://secure.agaresmedia.com/v6/products/phpautovideo Dork: Copyright Agares Media phpautovideo Author: GoLdeN-z3r0 ----------------------------------------------------------------- | PoC : |...

boastMachine <= 3.1 - CSRF Add Admin Vulnerability

No description provided by source. Exploit Title: boastMachine v3.1 = CSRF Add Admin Vulnerability Date: 28/3/2012 Author: Dr.NaNo Software Link: http://boastology.com/pages/dload.php?id=bmachine-3.1.zip Version: 3.1 Tested on: Linux-Red-Hat Google Dork: Powered by boastMachine v3.1 Exploit html...

SecurityComponent cross form submission issue

More info at https://bakery.cakephp.org/2014/04/29/CakePHP-1-3-18-and-2-4-8-released.html...

SecurityComponent cross form submission issue

More info at https://bakery.cakephp.org/2014/04/29/CakePHP-1-3-18-and-2-4-8-released.html...

Discuz! X A XSS-vulnerability warning-the black bar safety net

Self XSS + Click Jacking == storage type XSS http://hi.baidu.com/hacklele/admin.php?frames=yes&action=moderate&operation=threads, the page has a hidden form"title", you can GET submitted, the Management click"Submit"after the trigger. Because it is a Self XSS, bad use, and Discuz the background i...

Mail.ru: No CSRF token used in Phone Verification POST

When I tried to register in mail.ru,I submitted my phone number and Got a verification code in my phone. During submission of that code,I saw that POST goes without any CSRF tokens.And I identified two other vulnerabilities on that procedure. 1. No Session Verification on server side while...

Savsoft Quiz跨站请求伪造漏洞

Savsoft Quiz是基于PHP的在线测验web应用程序。 应用程序允许用户通过未经验证检查的HTTP请求执行某些操作，攻击者可以利用漏洞在欺骗管理员用户登录特制网页时已管理权限创建用户。 0 Savsoft Quiz 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://savsoftquiz.com/web/ form method="POST" name="form0" action="http://savsoftquiz.com/quizdemo/index.php/userdata/insertuser" input...

Piwigo 'ws.php'跨站请求伪造漏洞

Bugtraq ID:65811 Piwigo是一个基于MySQL5与PHP5开发的相册系统。 Piwigo存在一个跨站请求伪造漏洞，允许远程攻击者构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作。 0 Piwigo 2.6.1 目前没有详细解决方案提供： http://it.piwigo.org/ !DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN' html lang="en" head titlePiwigo 2.6.1/title /head body form...

SA-CONTRIB-2014-007 - Services - Multiple access bypass vulnerabilities

This module enables you to expose an API to third party systems using REST, XML-RPC or other protocols. The form API provides a method for developers to submit forms programmatically using the function drupalformsubmit. During programmatic form submissions, all access checks are deliberately...

Auto Classifieds Script 2.0添加管理员CSRF漏洞

No description provided by source. Auto Classifieds Script v2.0 - CSRF Vulnerabilty Add Admin ==================================================================== .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...

HackerOne: Switching the user to the attacker's account

Two requests are needed to make it happen. Request1 log out the user: Request2 log in the user to the attacker's account: Please let me know if more detailed description is needed. Regards, Dawid Czagan...

EZGenerator Cross Site Request Forgery / File Disclosure

EZGenerator – Local File Disclosure/Admin Data/CSRF Vulnerability ================================================================= .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Dork : inurl:”utils.php?action=...

Dredge School Administration System - DSMloader.php Cross-Site Request Forgery (Admin Account Manipulation)

Dredge School Administration System - DSMloader.php Cross-Site Request Forgery Admin Account Manipulation source: https://www.securityfocus.com/bid/64720/info Dredge School Administration System is prone to the following security vulnerabilities: 1. An SQL-injection vulnerability 2. A cross-site...

Ovidentia 7.9.6 - Multiple Vulnerabilities

Exploit Title: Ovidentia 7.9.6 Multiple Vulnerabilities Author: sajith version: Ovidentia 7.9.6 Vendor Homepage: http://www.ovidentia.org/ vulnerable app link:http://www.ovidentia.org/telecharger 1SQL injection vulnerability Log into admin panel and access delegate functionality managing...

MGASA-2013-0321 Updated chromium-browser-stable packages fix multiple vulnerabilities

Updated chromium-browser-stable packages fix security vulnerabilities: Atte Kettunen of OUSPG discover a use-after-free issue in Blink's XML HTTP request implementation CVE-2013-2925. cloudfuzzer discovered a use-after-free issue in the list indenting implementation CVE-2013-2926. cloudfuzzer...

Debian DSA-2785-1 : chromium-browser - several vulnerabilities

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2013-2906 Atte Kettunen of OUSPG discovered race conditions in Web Audio. - CVE-2013-2907 Boris Zbarsky discovered an out-of-bounds read in window.prototype. - CVE-2013-2908 Chamal de Silva discovered an address bar...