Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the 1 buried or 2 featured status of a comment via a request to wp-admin/admin-ajax.php...

CVE-2014-4163

The CVE-2014-4163 entry documents a CSRF vulnerability in the WordPress Featured Comments plugin (version 1.2.1). The issue allows an attacker to hijack administrator-authenticated requests to wp-admin/admin-ajax.php to change a comment’s status (buried/featured). Affected software: Featured Comm...

PT-2014-5713

Name of the Vulnerable Software and Affected Versions Zyxel P-660HW-T1 version v3 Description The issue affects the Zyxel P-660HW-T1 wireless router, where multiple cross-site request forgery CSRF vulnerabilities exist. These vulnerabilities allow remote attackers to hijack the authentication of...

CVE-2014-4163: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the 1 buried or 2 featured status of a comment via a request to wp-admin/admin-ajax.php...

CVE-2014-4162: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Zyxel P-660HW-T1 v3 wireless router allow remote attackers to hijack the authentication of administrators for requests that change the 1 wifi password or 2 SSID via a request to Forms/WLANGeneral1...

Bilyoner mobile apps prone to various SSL/TLS attacks

===================================================================== Sceptive Security Advisory Synopsis: Bilyoner mobile apps prone to various SSL/TLS attacks Product: Various mobile applications Advisory URL: http://sceptive.com/p/bilyoner-mobile-apps-prone-to-various-ssltls-attacks Advisory...

openSUSE Security Update : kernel (openSUSE-SU-2011:0861-1)

The openSUSE 11.3 kernel was updated to 2.6.34.10 to fix various bugs and security issues. Following security issues have been fixed: CVE-2011-2495: The /proc/PID/io interface could be used by local attackers to gain information on other processes like number of password characters typed or...

Samsung Cross Site Scripting

Advisory: design.samsung.com– Cross-Site Script Vulnerability XSS Advisory ID: 03062014 Author: Roberto Garcia @1gbDeInfo Affected Software: Successfully tested on design.samsung.com Vendor URL: http://www.design.samsung.com Vendor Status: informed and solved Vulnerability Description The website...

CVE-2014-3850: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Profiles component in IBM Connections through 3.0.1.1 CR3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that trigger follow actions...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM Tivoli Identity Manager ITIM 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager ISIM 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS...

PT-2014-3952

Name of the Vulnerable Software and Affected Versions IBM Connections versions prior to 3.0.1.1 CR3 Description A cross-site request forgery issue exists in the Profiles component, allowing remote authenticated users to hijack the authentication of arbitrary users for requests that trigger follow...

CVE-2014-0961: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in IBM Tivoli Identity Manager ITIM 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager ISIM 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS...

CVE-2014-0929: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Profiles component in IBM Connections through 3.0.1.1 CR3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that trigger follow actions...

PT-2014-3978

Name of the Vulnerable Software and Affected Versions IBM Tivoli Identity Manager versions 5.0 through 5.0.0.15 IBM Tivoli Identity Manager versions 5.1 through 5.1.0.15 IBM Security Identity Manager versions 6.0 through 6.0.0.2 Description A cross-site request forgery CSRF issue allows remote...

PT-2014-5539

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 6.0.3 Description The issue allows remote attackers to hijack user authentication for various requests, including conducting cross-site scripting XSS attacks, modifying files, or renaming files. Recommendation...

CVE-2014-3836: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud Server before 6.0.3 allow remote attackers to hijack the authentication of users for requests that 1 conduct cross-site scripting XSS attacks, 2 modify files, or 3 rename files via unspecified vectors...

CVE-2013-3258

Cross-site request forgery CSRF vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors...

DEBIAN-CVE-2012-5391

Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the sessionid...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors...