Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to hijack the authentication of unspecified victims for requests that modify user accounts...

CVE-2012-0286

Stoneware webNetwork prior to 6.0.8.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that can allow remote attackers to hijack user authentication and perform requests that modify user accounts. The issue is documented in CVE-2012-0286 and reflected across multiple feeds (NVD/Re...

JBoss 'mod_cluster'安全绕过漏洞

Bugtraq ID: 51554 CVE ID：CVE-2011-4608 JBOSS是一个基于J2EE的开放源代码的应用服务器。 modcluster允许worker节点在任意虚拟主机vhost上注册，而无视应用在其他虚拟主机上的安全性限制。在某些环境下，一个vhost配置为内部worker节点，而另一个配置为服务外部内容。远程攻击者可以利用此缺陷通过没有配置应用安全限制的外部虚拟主机注册为攻击者控制的worker节点，然后使用worker节点服务恶意内容，截获验证凭据，劫持用户会话。 0 Red Hat JBoss Enterprise Web Server for RHEL 6...

mod_cluster: malicious worker nodes can register on any vhost

modcluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from ...

mod_cluster: malicious worker nodes can register on any vhost

modcluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from ...

MegaSWF Cross Site Scripting

Title: ====== MegaSWF - Persistant Cross Site Scripting Vulnerability Date: ===== 2012-01-12 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=368 VL-ID: ===== 368 Introduction: ============= Do you create Flash games, Flash animations, or any other type of content saved ...

SA-CONTRIB-2012-008 - Video Filter - Cross Site Scripting

CVE: CVE-2012-1634 The Video Filter module lets you display videos from various third party sources. When videos from Blip.tv are shown, the module fails to sanitize source data before display. This vulnerability is mitigated by the fact that the attacker has to be able to either control the sour...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in postbug.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that create bug reports...

CVE-2011-5011

Multiple cross-site request forgery CSRF vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that 1 set a New user to Admin via the cID parameter to a statusconfirm action in admin/customers.php and 2 grant...

PT-2011-5166 · Xt:Commerce · Xt:Commerce

Name of the Vulnerable Software and Affected Versions: xt:Commerce versions 3.0.4 SP2.1 and earlier Description: The issue allows remote attackers to hijack the authentication of admins for specific requests. This can be achieved through cross-site request forgery CSRF vulnerabilities. The...

CVE-2011-3836

Multiple cross-site request forgery CSRF vulnerabilities in Wuzly 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 add an administrator, 2 perform cross-site scripting XSS, 3 perform SQL injection, or have other unspecified impact via unknown vectors...

KLA10304 LPE vulnerability in RSA SecurID Software Token

An untrusted path vulnerability was found in the RSA SecurID Software Token. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited locally via a DLL hijack. Original advisories - Related products RSA-SecurID-Software-Token CVE list CVE-2011-4141...

CVE-2011-4837

Cross-site request forgery CSRF vulnerability in /ctrl in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to hijack the authentication of admins for requests that execute arbitrary programs...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in /ctrl in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to hijack the authentication of admins for requests that execute arbitrary programs...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the management interface in FreeIPA before 2.1.4 allows remote attackers to hijack the authentication of administrators for requests that make configuration changes...

CVE-2011-3636

Cross-site request forgery CSRF vulnerability in the management interface in FreeIPA before 2.1.4 allows remote attackers to hijack the authentication of administrators for requests that make configuration changes...

ExpressionEngine 2.2.2 / CodeIgniter 2.0.3 Cross Site Scripting

CVE: CVE-2011-4025 Vendor: EllisLab Products: ExpressionEngine 2.2.2, CodeIgniter 2.0.3 Vulnerabilities: xssclean filter bypass, leading to Cross-Site Scripting XSS Risk: High Attack Vector: From Remote Reference: http://secureappdev.blogspot.com/2011/11/ellislab-xssclean-filter-bypass.html 1...

Researchers: Millions of Printers Vulnerable to Attack

Columbia University researchers say tens of millions of printers may have flawed firmware that could allow hackers to remotely set fires, erase code and infiltrate computer networks, according to a report on MSNBC’s Red Tape Chronicles blog today. Research conducted in the Computer Science...

Linux/MIPS - add userUID 0 with password - 164 bytes

Linux/MIPS - add userUID 0 with password - 164 bytes. Shellcode exploit for linux platform / Title: Linux/MIPS -add userUID 0 with password - 164 bytes Date: 2011-11-24 Author: rigan - imrigan at gmail.com Note: Username - rOOt Password - pwn3d / include char sc = "\x24\x09\x73\x50" // li t1,2952...

CVE-2011-2773

Cross-site request forgery CSRF vulnerability in Mahara before 1.4.1 allows remote attackers to hijack the authentication of administrators for requests that add a user to an institution...