CVE-2012-4753

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.5 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-4391

Cross-site request forgery CSRF vulnerability in core/ajax/appconfig.php in ownCloud before 4.0.7 allows remote attackers to hijack the authentication of administrators for requests that edit the app configurations...

CVE-2012-4393

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use 1 addBookmark.php, 2 delBookmark.php, or 3 editBookmark.php in bookmarks/ajax/; 4 calendar/delete.php, 5 calendar/edit.php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use 1 addBookmark.php, 2 delBookmark.php, or 3 editBookmark.php in bookmarks/ajax/; 4 calendar/delete.php, 5 calendar/edit.php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.5 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in core/ajax/appconfig.php in ownCloud before 4.0.7 allows remote attackers to hijack the authentication of administrators for requests that edit the app configurations...

CVE-2012-4393

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use 1 addBookmark.php, 2 delBookmark.php, or 3 editBookmark.php in bookmarks/ajax/; 4 calendar/delete.php, 5 calendar/edit.php...

CVE-2012-4393

ownCloud before 4.0.6 has multiple CSRF vulnerabilities across 37+ endpoints (e.g., bookmarks, calendar, files, sharing, tasks) that allow remote attackers to hijack user sessions. Red Hat notes that appconfig.php access isn’t properly restricted, enabling edits by remote authenticated users and ...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the AdminUsers component in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to hijack the authentication of administrators for requests that remove arbitrary user accounts via a delete operation, as demonstrated by an image action...

New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions

There is a feature supported by the SSL/TLS encryption standard and used by most of the major browsers that leaks enough information about encrypted sessions to enable attackers decrypt users’ supposedly protected cookies and hijack their sessions. The researchers who developed the attack that...

CVE-2012-4746

Cross-site request forgery CSRF vulnerability in accessaccount.cgi in ZTE ZXDSL 831IIV7.5.0aZ29OV allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Commerce Reorder module before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that add items to the shopping cart...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in accessaccount.cgi in ZTE ZXDSL 831IIV7.5.0aZ29OV allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter...

CVE-2012-2116

Cross-site request forgery CSRF vulnerability in the Commerce Reorder module before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that add items to the shopping cart...

CVE-2012-4746

The CVE-2012-4746 issue affects ZTE ZXDSL 831IIV7.5.0a_Z29_OV, specifically a CSRF in accessaccount.cgi that lets remote attackers hijack administrator authentication to change the admin password via the sysPassword parameter. The NVD entry lists a Network attack vector with no authentication and...

CVE-2011-5131

Cross-site request forgery CSRF vulnerability in global.php in MyBB before 1.6.5 allows remote attackers to hijack the authentication of a user for requests that change the user's language via the language parameter...

CVE-2012-3309

Cross-site request forgery CSRF vulnerability in the account-creation panel in IBM InfoSphere Guardium 8.2 and earlier, when the CSRF filtering aka csrfstatus feature is disabled, allows remote attackers to hijack the authentication of administrators for requests that create administrative accoun...

CVE-2012-0308

Cross-site request forgery CSRF vulnerability in Symantec Messaging Gateway SMG before 10.0 allows remote attackers to hijack the authentication of administrators...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Symantec Messaging Gateway SMG before 10.0 allows remote attackers to hijack the authentication of administrators...

CVE-2012-0308

Summary (CVE-2012-0308): Symantec Messaging Gateway (SMG) prior to version 10.0 is vulnerable to a Cross-Site Request Forgery (CSRF) that can hijack the authentication of administrators. The issue stems from insufficient input validation, enabling a remote attacker to entice a logged-in admin to ...