Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the clickthrough tracking functionality in the Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that increase node rankings via the...

CVE-2012-1056

The Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal does not properly enforce permissions for 1 Recent forwards, 2 Most forwarded, or 3 Dynamic blocks, which allows remote attackers to obtain node titles via unspecified vectors...

CVE-2012-1057

Cross-site request forgery CSRF vulnerability in the clickthrough tracking functionality in the Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that increase node rankings via the...

Code injection

The Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal does not properly enforce permissions for 1 Recent forwards, 2 Most forwarded, or 3 Dynamic blocks, which allows remote attackers to obtain node titles via unspecified vectors...

CVE-2012-1057

Cross-site request forgery CSRF vulnerability in the clickthrough tracking functionality in the Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that increase node rankings via the...

CVE-2012-1056

CVE-2012-1056 concerns the Drupal Forward module (6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3). The issue is improper permission checks for the Recent forwards, Most forwarded, and Dynamic blocks, enabling remote attackers to obtain node titles via unspecified vectors. The related Drupal S...

CVE-2012-1057

CVE-2012-1057 describes a CSRF vulnerability in the Forward module (Drupal) across 6.x-1.x and 7.x-1.x series, where the clickthrough tracking feature could be abused to hijack an administrator’s session and raise node rankings via tracking requests, potentially linked to inadequate flood control...

CVE-2012-1056

The Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal does not properly enforce permissions for 1 Recent forwards, 2 Most forwarded, or 3 Dynamic blocks, which allows remote attackers to obtain node titles via unspecified vectors...

SA-CONTRIB-2012-016 - Forward module CSRF and Access bypass

The Forward module enables you to add a "forward this page" link to each node. The link takes regular site visitors to a form where they can generate an email to a friend. The module exhibits multiple vulnerabilities as described below. The module includes "Recent forwards" and "Most forwarded"...

SSL Perfect Forward Secrecy Cipher Suites Supported

The remote host supports the use of SSL ciphers that offer Perfect Forward Secrecy PFS encryption. These cipher suites ensure that recorded SSL traffic cannot be broken at a future date if the server's private key is compromised. C Tenable Network Security, Inc. include"compat.inc"; if descriptio...

Reverse incremental job scheduling does not work properly

Challenge Reverse incremental job starts ignoring their scheduled settings, and run on the days selected for Synthetic Fulls, even when the check-box is grayed out. Solution To resolve the issue you need to enable forward incremental mode in the job settings and deselect "Enable synthetic fulls"...

Google Implements Forward Secrecy

Google is stepping up their security game in a big way for the second time this year: introducing a more secure browsing method known as forward secrecy in Gmail and a number of other Web-based services, according to a post on the GoogleOnlineSecurity blog. In recent months, the Silicon Valley...

Multi Gather DNS Forward Lookup Bruteforce

Brute force subdomains and hostnames via wordlist. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multi Gather DNS Forward Lookup Bruteforce', 'Description' = %q Brute force subdomains and...

Apache Patch released for Reverse proxy Bypass Vulnerability

Apache Patch released for Reverse proxy Bypass Vulnerability Security experts at Context have discovered a hole in the Apache web server that allows remote attackers to access internal servers. Security experts are warning firms running the Apache web server to keep up to date with the latest...

CVE-2011-2848

Removed by vendor...

SA-CONTRIB-2011-035 Forward module - Open redirect

The Forward module enables you to add a "forward this page" link to each node. The link takes regular site visitors to a form where they can generate an email to a friend. The module doesn't check to ensure that the page being forwarded refers to an internal path. This could allow someone to hard...

phpList 2.10.x - Security Bypass / Information Disclosure

source: https://www.securityfocus.com/bid/49188/info PHPList is prone to a security-bypass vulnerability and an information-disclosure vulnerability. An attacker can exploit these issues to gain access to sensitive information and send arbitrary messages to registered users. Other attacks are als...

DNS Spoofing - Man in the Middle (Basic Attack)

Document Title: =============== DNS Spoofing - Man in the Middle Basic Attack References: =========== Download: http://www.vulnerability-lab.com/resources/videos/16.wmv View: http://www.youtube.com/watch?v=9HWvUgSk0Y Release Date: ============= 2011-06-12 Vulnerability Laboratory ID VL-ID:...

CVE-2010-4766

The AgentTicketForward feature in Open Ticket Request System OTRS before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a forwarded message in a...

openldap: forwarded bind failure messages cause success

chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicyforwardupdates aka authentication-failure forwarding is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a sla...