bugzilla -- Cross-Site Request Forgery

A Bugzilla Security Advisory reports: The login form had no CSRF protection, meaning that an attacker could force the victim to log in using the attacker's credentials. If the victim then reports a new security sensitive bug, the attacker would get immediate access to this bug. Due to changes...

IRCCloud: Login CSRF

Hi sir, There is no mitigation of XCSRF in your login form. Kindly check the source code of login: Login Forgotten your password? kindly let me know if you needed more information. Clifford...

CVE-2014-2586

Cross-site scripting XSS vulnerability in the login audit form in McAfee Cloud Single Sign On SSO allows remote attackers to inject arbitrary web script or HTML via a crafted password...

PT-2014-2144 · Red Hat · Spacewalk

Name of the Vulnerable Software and Affected Versions: Spacewalk version 1.6 Description: A cross-site scripting XSS issue exists in the Lookup Login/Password form, allowing remote attackers to inject arbitrary web script or HTML via the URI. This could potentially lead to unauthorized access or...

tomcat: Session fixation in form authenticator

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a...

tomcat: Session fixation in form authenticator

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a...

tomcat: Session fixation in form authenticator

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a...

tomcat: Session fixation in form authenticator

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a...

tomcat: Session fixation in form authenticator

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a...

BF, CSRF, AoF and IAA vulnerabilities in MODx Revolution

Hello 3APA3A! I want to warn you about multiple vulnerabilities in MODx Revolution. These are Brute Force, Cross-Site Request Forgery, Abuse of Functionality and Insufficient Anti-automation vulnerabilities in MODx. It's about 2.x Revolution versions of MODx. In 0.x and 1.x Evolution versions of...

MODX CMS 1.x - 2.x Brute Force and Path Disclosure Vulnerabilities - Active Check

MODX CMS is prone to brute force and path disclosure vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Friendsinwar FAQ Manager XSS / SQL Injection

Exploit Title: friendsinwar FAQ Manager SQL Injection authbypass Vulnerability Date: 13.10.201 Exploit Author: d3b4g Vendor Homepage: http://www.friendsinwar.com Software Link: http://www.friendsinwar.com/scriptdemo/thefaqmanager/ Tested on: Windows 7 Blog: d3b4g.me...

BF and XSS vulnerabilities in IFOBS

Hello 3APA3A! I want to warn you about Brute Force and Cross-Site Scripting vulnerabilities in system IFOBS. IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks. These are the next 36 vulnerabilities in IFOBS: 2 BF and 34 XSS in...

IFOBS Cross Site Request Forgery / Cross Site Scripting

Hello list! I want to warn you about Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in system IFOBS. IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks. These are the next 35 vulnerabilities in IFOBS: 1 CSRF...

DOS attack in FOSUserBundle login form

More info at https://symfony.com/cve-2013-5750...

Fluger Edit 2 Blind SQL Injection / Cross Site Scripting Vulnerability

Exploit for php platform in category web applications ===================================================== Vulnerable Software: Fluger Edit v.2 || administration software Vendor: http://www.fluger.com/ Software License: Commercial Vulnerabilities: Blind SQL Injection And XSS Tested: In Wild...

Fluger Edit 2 Blind SQL Injection / Cross Site Scripting

===================================================== Vulnerable Software: Fluger Edit v.2 || administration software Vendor: http://www.fluger.com/ Software License: Commercial Vulnerabilities: Blind SQL Injection And XSS Tested: In Wild ===================================================== Dork...

Jaow CMS 2.3 - Blind SQL Injection

Author: loneferret of Offensive Security Product: Jaow CMS Version: v2.3 Vendor Site: http://www.jaow.net Software Download: http://www.jaow.net Description: Small free CMS application, no programming experienced needed to install and administer. Vulnerability: Blind-SQL in login form. Page:...

Ganesha Digital Library 4.0 - Multiple Vulnerabilities

Ganesha Digital Library 4.0 - Multiple Vulnerabilities ===================================================== Ganesha Digital Library 4.0 Multiple Vulnerabilities =====================================================...

Ganesha Digital Library 4.0 - Multiple Vulnerabilities

===================================================== Ganesha Digital Library 4.0 Multiple Vulnerabilities ===================================================== :---------------------------------------------------------------------------------------------------------------------------------------...