CVE-2013-1972

Cross-site request forgery CSRF vulnerability in the elFinder file manager module 6.x-0.x before 6.x-0.8 and 7.x-0.x before 7.x-0.8 for Drupal allows remote attackers to hijack the authentication of unspecified victims to create, modify, or delete files via unknown vectors...

JBoss Enterprise Application Platform 6.1.0 Update (RHSA-2013:0833)

The version of JBoss Enterprise Application Platform 6.0.1 running on the remote system is vulnerable to the following issues: - A man-in-the-middle attack is possible when applications running on JBoss Web use the COOKIE session tracking method. The flaw is in the...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings...

CVE-2013-3250

Cross-site request forgery CSRF vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings...

CVE-2013-4629

The Huawei viewpoint VP9610 and VP9620 units for the Huawei Video Conference system do not update the Session ID upon successful establishment of a login session, which allows remote authenticated users to hijack sessions via an unspecified interception method...

Design/Logic Flaw

The HTTP module in the 1 Branch Intelligent Management System BIMS and 2 web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, and S7800 switches uses predictable Session ID values, which makes it easier for remote attackers to hijack sessions via a...

CVE-2012-6571

The HTTP module in the 1 Branch Intelligent Management System BIMS and 2 web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, and S7800 switches uses predictable Session ID values, which makes it easier for remote attackers to hijack sessions via a...

CVE-2012-6571

The CVE-2012-6571 issue affects Huawei devices (AR routers and S-series switches: S2000, S3000, S3500, S3900, S5100, S5600, S7800). The HTTP module in the BIMS/web management components uses predictable Session ID values, enabling remote attackers to hijack sessions via brute-force. This is docum...

Siemens SCALANCE X-200 Web Hijack Vulnerability

OVERVIEW Siemens has identified a Web hijack vulnerability in the SCALANCE X-200 switch product family. Researcher Eireann Leverett of IOActive coordinated disclosure of the vulnerability with Siemens. Siemens has produced a firmware update that mitigates this vulnerability. This vulnerability...

Linkedin Social Network - Persistent Web Vulnerability

Document Title: =============== Linkedin Social Network - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=962 Linkedin Security Ticket ID: 130429-005211 Release Date: ============= 2013-06-07 Vulnerability Laboratory ID VL-ID...

CVE-2013-2318

The Content Provider in the MovatwiTouch application before 1.793 and MovatwiTouch Paid application before 1.793 for Android does not properly restrict access to authorization information, which allows attackers to hijack Twitter accounts via a crafted application...

CVE-2013-2318

The Content Provider in the MovatwiTouch application before 1.793 and MovatwiTouch Paid application before 1.793 for Android does not properly restrict access to authorization information, which allows attackers to hijack Twitter accounts via a crafted application...

CVE-2013-2318

CVE-2013-2318 affects MovatwiTouch for Android (before v1.793) and MovatwiTouch Paid (before v1.793). The Content Provider fails to restrict access to authorization information, enabling a crafted Android application to hijack a user’s Twitter account by abusing the permission exposure. The issue...

泛域名劫持暗链

No description provided by source...

Session fixation

Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors...

Session fixation

Session fixation vulnerability in Cisco Secure Access Control System ACS allows remote attackers to hijack web sessions via unspecified vectors, aka Bug ID CSCud95787...

CVE-2013-2707

Cross-site request forgery CSRF vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings...

Barracuda Bug Bounty #9 CT - Cross Site Vulnerabilities

Document Title: =============== Barracuda Bug Bounty 9 CT - Cross Site Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=577 Barracuda Networks Security ID: BNSEC-305 Release Date: ============= 2013-05-09 Vulnerability Laboratory ID VL-ID:...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hijack the authentication of unspecified victims for requests that 1 store XSS sequences or 2 delete entries...

CVE-2013-3513

Multiple cross-site request forgery CSRF vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hijack the authentication of unspecified victims for requests that 1 store XSS sequences or 2 delete entries...