LocalTapiola: CSRF allows attacker to delete item from customer's "Postilaatikko"

Description If the customer navigates to the CSRF-attack page shortly after viewing any message details on the "Postilaatikko", the last item that was viewed by the customer will be deleted. Please see the attached video for an illustration of the bug. Steps to reproduce 1. Log in to the...

[SECURITY] Fedora 21 Update: imapsync-1.644-2.fc21

imapsync is a tool for facilitating incremental recursive IMAP transfers from one mailbox to another. It is useful for mailbox migration, and reduces the amount of data transferred by only copying messages that are not present on both servers. Read, unread, and deleted flags are preser ved, and t...

Ecmall Sql 注入 第一枚。

简要描述： 打了补丁试试。 详细说明： 在app/message.app.php中 function drop $msgids = isset$GET'msgid' ? trim$GET'msgid' : ''; if !$msgids $this-showwarning'nosuchmessage'; return; $msgids = explode',',$msgids; $modmessage = &m'message'; foreach $msgids as $key=$msgid $message = $modmessage-findintval$msgid; $messag...

[SECURITY] Fedora 20 Update: imapsync-1.584-1.fc20

imapsync is a tool for facilitating incremental recursive IMAP transfers from one mailbox to another. It is useful for mailbox migration, and reduces the amount of data transferred by only copying messages that are not present on both servers. Read, unread, and deleted flags are preser ved, and t...

shopex ctl. member. php file SQL injection vulnerability-vulnerability warning-the black bar safety net

Issql injectionvulnerability testing version: shopex-singel-4.8.5.78660 File:\core\shop\controller\ctl.member.php function delTrackMsg if! empty$POST'deltrack' $oMsg = &$this-system-loadModel'resources/msgbox'; $oMsg-delTrackMsg$POST'deltrack'; $this-splash'success',...

Mutare Software EVM 2.2.9 Cross Site Request Forgery / Cross Site Scripting

Description: Mutare Software EVM 2.2.9 possibly earlier versions is vulnerable to CSRF and XSS. An attacker could do the following to a users' EVM settings: A. Change their EVM PIN B. Delete all of their voice messages C. Change or add any of their delivery address for voicemails CERT Vulnerabili...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that 1 change a PIN, 2 delete messages, 3 add a delivery address, or 4 change a delivery address...

CVE-2011-1104

Multiple cross-site request forgery CSRF vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that 1 change a PIN, 2 delete messages, 3 add a delivery address, or 4 change a delivery address...

Sun Java System Communications Express XSRF

Hello, As a continuation of my advisory about "Sun Java System Communications Express Multiple HTML Injection Vulnerabilities" that can be found here: http://www.securityfocus.com/bid/34083/info, I would like to introduce another potential security threat in the same product and based on my...

PHP-Fusion 7.00.1 - messages.php SQL Injection

PHP-Fusion 7.00.1 - messages.php SQL Injection \n" . " php $argv0 localhost /php-fusion/ user s3cret "SELECT database"\n". " php $argv0 localhost / user s3cret "SELECT loadfile0x2F6574632F706173737764"\n\n"; die; echo "Logging into system..."; //login to php-fusion using login and pass...

CVE-2007-6018

IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to 1 delete arbitrary e-mail messages via a modified numeric ID or 2 "purge" deleted emails via a crafted email message...

CVE-2008-0788

Multiple cross-site request forgery CSRF vulnerabilities in MyBB 1.2.11 and earlier allow remote attackers to 1 hijack the authentication of moderators or administrators for requests that delete threads via a domultideletethreads action to moderation.php and 2 hijack the authentication of arbitra...

MultiTheftAuto 0.5 patch 1 Server Crash and MOTD Deletion Exploit

Exploit for unknown platform in category dos / poc ================================================================= MultiTheftAuto 0.5 patch 1 Server Crash and MOTD Deletion Exploit ================================================================= / by Luigi Auriemma / include include ifdef WIN3...

Software PBLang 4.63 delpm.php authentication vulnerability

HRG - Hackerlounge Research Group Release: HRG009 Monday 03/01/05 Software PBLang 4.63 delpm.php authentication problem The author can't be held responsible for any damage done by a reader. You have your own resonsibility Please use this document like it's meant to. Vulnerable: PBLang 4.63 and...

PBLang Bulletin Board System 4.x - 'DelPM.php' Arbitrary Personal Message Deletion

source: https://www.securityfocus.com/bid/12694/info PBLang is reported prone to a vulnerability that can allow a registered user to delete arbitrary personal messages. The vulnerability exists due to a design error leading to a lack of access controls...

PBLang BBS <= 4.65 Multiple Vulnerabilities

According to its banner, the remote host is running a version of PBLang BBS, a bulletin board system written in PHP, that suffers from the following vulnerabilities: - HTML Injection Vulnerability in pmpshow.php. An attacker can inject arbitrary HTML and script into the body of PMs sent to users...

ASPjar guestbook &#40;Injection in login page&#41;

Go to /admin/login.asp and type in password field: ' or ''=' Also in some version of ASPjar , Attackers can delete messages . Go to /admin/delete.asp...

phpSQLnuke.pl

XSS/SQL Injection PHP-Nuke Delete Messages Bug by bima Php-Nuke is a popular freeware content management system. Based on information at : http://www.mantralab.org/modules.php/modulo/news/lanotizia/%5BXSS%5D+PHP-Nuke+7.4+Add+Message+Bug An attacker permitted to post to global home-page messages. ...

[XSS]/SQL Injection PHP-Nuke Delete Message&#40;s&#41; Bug

XSS/SQL Injection PHP-Nuke Delete Messages Bug by bima Php-Nuke is a popular freeware content management system. Based on information at : http://www.mantralab.org/modules.php/modulo/news/lanotizia/5BXSS5D+PHP-Nuke+7.4+Add+Message+Bug An attacker permitted to post to global home-page messages. I...

CVE-2002-2202

Outlook Express 6.0 does not delete messages from dbx files, even when a user empties the Deleted items folder, which allows local users to read other users email...