Authentication flaw

The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction...

CVE-2014-3552

The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction...

PT-2014-5390

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.3.11 Moodle versions 2.4.x prior to 2.4.11 Moodle versions 2.5.x prior to 2.5.7 Description The issue concerns the Shibboleth authentication plugin in Moodle, which fails to check if a session ID is empty. This allow...

PT-2014-5585

Name of the Vulnerable Software and Affected Versions acmailer versions prior to 3.8.17 acmailer versions 3.9.x prior to 3.9.10 Beta Description The issue allows remote attackers to hijack the authentication of arbitrary users for requests that modify or delete data. This can be demonstrated by...

CVE-2014-3896: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in CGI programs in Seeds acmailer before 3.8.17 and 3.9.x before 3.9.10 Beta allow remote attackers to hijack the authentication of arbitrary users for requests that modify or delete data, as demonstrated by modifying data affecting...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in php/useraccount.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts...

CVE-2014-2974: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in php/useraccount.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts...

PT-2014-4996

Name of the Vulnerable Software and Affected Versions Silver Peak VX versions prior to 6.2.5 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts. Recommendations For versions prior t...

CVE-2014-3305: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the web framework in Cisco WebEx Meetings Server 1.5.1.131 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuj81735...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new super user account via a request to admin/users/add, 2 insert cross-site scripting XSS sequences via the apikeylabel...

CVE-2014-5100

Omeka 2.2.1 prior to release is affected by multiple CSRF vulnerabilities that can hijack admin sessions. Exploitation vectors include: (1) adding a new super user via admin/users/add; (2) injecting XSS via the api_key_label parameter to admin/users/api-keys/1; and (3) disabling file validation v...

CVE-2014-5100

Multiple cross-site request forgery CSRF vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new super user account via a request to admin/users/add, 2 insert cross-site scripting XSS sequences via the apikeylabel...

CVE-2014-5100: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new super user account via a request to admin/users/add, 2 insert cross-site scripting XSS sequences via the apikeylabel...

PT-2014-6277

Name of the Vulnerable Software and Affected Versions Omeka versions prior to 2.2.1 Description The issue allows remote attackers to hijack the authentication of administrators for requests, including adding a new super user account via a request to "admin/users/add", inserting cross-site scripti...

PT-2014-4657

Name of the Vulnerable Software and Affected Versions Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals versions 8.1xx through 8.68x Description A cross-site request forgery CSRF issue exists in the web application, allowing remote authenticated users to hijack the authentication of unspecified...

CVE-2014-4964

Multiple cross-site request forgery CSRF vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to hijack the authentication of users for requests that 1 modify customer settings or hijack the authentication of administrators for requests that change 2 customer passwords, 3 shop...

CVE-2014-4964

Shopizer

PT-2014-6234

Name of the Vulnerable Software and Affected Versions Shopizer versions 1.1.5 and earlier Description The issue allows remote attackers to hijack user authentication for various requests, including modifying customer settings, changing customer passwords, altering shop configuration, and modifyin...

CVE-2014-4964: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to hijack the authentication of users for requests that 1 modify customer settings or hijack the authentication of administrators for requests that change 2 customer passwords, 3 shop...

Million cloud mailbox register logic flaws-vulnerability warning-the black bar safety net

Million network top level domain names sent to cloud mailbox activity, the cloud mailbox can be any resolution, may lead to phishing or fraud, specifically the details look at the following graphic, the language is not too easily described Some time ago promising a domain name, ready for...