CVE-2013-2705: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings...

PT-2014-5006

Name of the Vulnerable Software and Affected Versions Open Assessment Technologies TAO version 2.5.6 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to "Users/add"...

PT-2014-2613

Name of the Vulnerable Software and Affected Versions OpenVPN Access Server versions prior to 1.8.5 Description A cross-site request forgery CSRF issue exists in the Admin web interface, allowing remote attackers to hijack the authentication of administrators for requests that create administrati...

CVE-2013-2692: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows remote attackers to hijack the authentication of administrators for requests that create administrative users...

CVE-2014-3455

Multiple cross-site request forgery CSRF vulnerabilities in the 1 CreateProperty, 2 CreateTemplate, 3 CreateForm, and 4 CreateClass special pages in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allow remote attackers to hijack the...

CVE-2013-5748

Cross-site request forgery CSRF vulnerability in management/prioritizeplanning.php in SimpleRisk before 20130916-001 allows remote attackers to hijack the authentication of users for requests that add projects via an addproject action...

CVE-2014-3455

CVE-2014-3455 concerns CSRF vulnerabilities in the SemanticForms extension for MediaWiki, affecting CreateProperty, CreateTemplate, CreateForm, and CreateClass pages. The issue is described as allowing remote attackers to hijack user authentication for requests with unspecified impact and vectors...

CVE-2014-3454

The CVE-2014-3454 vulnerability affects MediaWiki via the SemanticForms extension, specifically when using Special:CreateCategory. The root cause is a CSRF flaw due to insufficient token validation, allowing remote attackers to hijack user authentication for category-creation requests. Affected v...

大汉Jvideo两处漏洞小合集（可能导致管理后台权限劫持）

简要描述： 两处。 详细说明： 一个是任意文件下载，一个是sql注入。 先看任意文件下载吧，任意文件下载可以下载到setup的相关安装信息，从而可以登录setup目录的管理后台 http://222.66.10.88:8081/jvideo/down.jsp?pathfile=WEB-INF/web.xml 来点好东西 http://222.66.10.88:8081/jvideo/down.jsp?pathfile=WEB-INF/ini/merpserver.ini 可以看见setup下Admin的密码（屏蔽了），登录成功 另外一个网站...

CVE-2014-3454: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Special:CreateCategory in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to hijack the authentication of users for requests that create categories via unspecified vecto...

CVE-2013-5748: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in management/prioritizeplanning.php in SimpleRisk before 20130916-001 allows remote attackers to hijack the authentication of users for requests that add projects via an addproject action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert...

CVE-2014-0944: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert...

CVE-2014-0090

Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie...

PT-2014-3474 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.4.2 Description: The issue allows remote attackers to hijack web sessions. This is achieved via the session id cookie. Recommendations: For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the...

CVE-2014-3115: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication of administrators via system/config/adminadd and other unspecified vectors...

PT-2014-4544

Name of the Vulnerable Software and Affected Versions Cisco Broadcast Access Center for Telco and Wireless BAC-TW affected versions not specified Description A cross-site request forgery CSRF issue in the web framework of Cisco BAC-TW allows remote attackers to hijack the authentication of...

CVE-2014-2190: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless aka BAC-TW allows remote attackers to hijack the authentication of arbitrary users for requests that make BAC-TW changes, aka Bug IDs CSCuo23804 and CSCuo26389...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the subscription page editor spageedit in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/...

PT-2014-4956

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.0.6 Description A cross-site request forgery CSRF issue exists in the subscription page editor spageedit of phpList, allowing remote attackers to hijack the authentication of administrators via a request to "admin/"...