CVE-2014-5346

The CVE-2014-5346 entry affects the WordPress Disqus Comment System plugin version 2.77. The vulnerability is Cross-Site Request Forgery (CSRF) that allows remote attackers to hijack the authentication of administrators for requests that (1) activate or (2) deactivate the plugin via the active pa...

PT-2014-6425

Name of the Vulnerable Software and Affected Versions Disqus Comment System plugin version 2.77 Description The issue affects the Disqus Comment System plugin, allowing remote attackers to hijack the authentication of administrators. This can be achieved through multiple cross-site request forger...

CVE-2014-5346: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 activate or 2 deactivate the plugin via the active parameter to wp-admin/edit-comments.php, 3...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x through 11.x before 11.3-IF2 allows remote...

PT-2014-3985

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Master Data Management - Collaborative Edition versions 10.x through 11.x before 11.0-FP5 IBM InfoSphere Master Data Management Server for Product Information Management versions 9.x through 11.x before 11.3-IF2 Description A...

CVE-2014-0969: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x through 11.x before 11.3-IF2 allows remote...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 create new FTP users via a CreateFTP action in the ftpmanagement module to the default URI, 2 conduct cross-site scriptin...

SuSE 11.3 Security Update : tomcat6 (SAT Patch Number 9487)

Tomcat has been updated to version 6.0.41, which brings security and bug fixes. The following security fixes have been fixed : - A XXE vulnerability via user-supplied XSLTs. CVE-2014-0096 - Request smuggling via malicious content length header. CVE-2014-0099 - A XML parser hijack by malicious web...

PT-2014-2352

Name of the Vulnerable Software and Affected Versions ZPanel versions 10.0.1 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests, including creating new FTP users, conducting cross-site scripting XSS attacks, and conducting SQL...

WordPress File Upload Plugin <= 2.4.1 - CSRF

Because of this vulnerability, the attackers can hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. Solution Update the plugin...

PT-2014-6338

Name of the Vulnerable Software and Affected Versions WordPress File Upload plugin wp-file-upload versions prior to 2.4.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that change plugin settings...

CVE-2014-5199: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the WordPress File Upload plugin wp-file-upload before 2.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are...

CVE-2014-5196: Improper Neutralization of Input During Web Page Generation

Cross-site request forgery CSRF vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the...

Tomcat/JBossWeb: XML parser hijack by malicious web application

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...

Tomcat/JBossWeb: XML parser hijack by malicious web application

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...

ABB RobotStudio and Test Signal Viewer DLL Hijack Vulnerability

OVERVIEW Ivan Sanchez of WiseSecurity Team has identified a dll hijack vulnerability in the ABB RobotStudio and Test Signal Viewer applications. ABB has produced new versions that mitigate this vulnerability. Mr. Sanchez has tested the new version to validate that it resolves the vulnerability...

CVE-2014-3854: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/addScript.py in Pyplate 0.08 allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the title parameter...

Poor Crypto on Instagram Mobile Apps Allow Man-in-the-Middle

Two unrelated researchers this week disclosed a similar session hijack bug in the Instagram mobile applications for Android and iOS. Facebook has reportedly acknowledged the problem, which arose from a failure to fully encrypt all data traffic on the service, but the world’s largest social networ...

CVE-2014-3896

CVE-2014-3896 involves multiple CSRF vulnerabilities in Seeds acmailer CGI programs. Affected: acmailer &lt; 3.8.17 and

CVE-2014-3552

The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction...