X (Formerly Twitter): Bypassing Digits bridge origin validation

Hi, I would like to report an issue in the bridge proxy in Digits which allows attacker to retrieve the OAuth credential data of an application victims authorized. Detail In the Digits Web SDK, the method getLoginStatus can be used to retrieve the OAuth credential data of an application if the us...

Oxwall Cross-Site Request Forgery Vulnerability

Oxwall is a fully functional SNS social networking system developed using PHP+MySQL. Oxwall has a cross-site request forgery vulnerability. The "/admin/pages/maintenance" script fails to properly validate the origin of HTTP requests. Allowing an attacker to steal cookies from other users, spread...

pfSense XSS and CSRF Vulnerabilities (pfSense-SA-15_04.webgui)

pfSense is prone to multiple cross-site scripting XSS vulnerabilities and a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

PT-2015-4548

Name of the Vulnerable Software and Affected Versions OpenStack Compute Nova versions prior to 2014.1.4 OpenStack Compute Nova 2014.2.x versions prior to 2014.2.3 OpenStack Compute Nova kilo versions prior to kilo-3 Description The issue concerns the failure to validate the origin of websocket...

libmnl: incorrect validation of netlink message origin allows attackers to spoof netlink messages

The netlinksendmsg function in net/netlink/afnetlink.c in the Linux kernel before 3.5.5 does not validate the dstpid field, which allows local users to have an unspecified impact by spoofing Netlink messages...

CVE-2014-3429

IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page...

Active Classifieds 1.0 Arbitrary Code Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2942/info Active Classifieds is a CGI package that provides an online classified advertisement listing and management system. An origin validation error exists in the Free Edition of Active Classifieds that may allow remo...

UBUNTU-CVE-2012-2669

The main function in tools/hv/hvkvpdaemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message...

Multiple Vulnerabilities in CosmoShop

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in CosmoShop which can be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerabilities in CosmoShop 1.1 The vulnerability exists due to input sanitatio...

Multiple Vulnerabilities in xtcModified

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in xtcModified which could be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerabilities in xtcModified 1.1 The vulnerability exists due to input...

Multiple Vulnerabilities in ViArt Shop

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ViArt Shop which could be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerability in ViArt Shop The vulnerability exists due to input sanitation...

Multiple Vulnerabilities in VaM Shop

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in VaM Shop which could be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerabilities in VaM Shop: CVE-2011-0504 1.1 The vulnerability exists due to...

Cross-site Request Forgery (CSRF) Vulnerabilities in Ronny CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Ronny CMS which could be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery CSRF in Ronny CMS 1.1 The vulnerability exists due to insufficient validation of the request origin i...

Microsoft Internet Explorer Multiple Vulnerabilities (2183461)

This host is missing a critical security update according to Microsoft Bulletin MS10-053. OpenVAS Vulnerability Test $Id: secpodms10-053.nasl 6527 2017-07-05 05:56:34Z cfischer $ Microsoft Internet Explorer Multiple Vulnerabilities 2183461 Authors: Sooraj KS Updated By: Madhuri D on 2010-09-12 - ...

Microsoft Help Files (.CHM): 'Locked File' Feature Bypass

, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. Microsoft Help Files .CHM: 'Locked File' Bypass Versions Affected: Windows XP, Windows Vista, Windows 7 pdf: http://www.security-assessment.com/files/advisories/WindowsLockedHelpFiles.pdf...

Linux Kernel 2.6.x - Cloned Process 'CLONE_PARENT' Local Origin Validation

/ source: https://www.securityfocus.com/bid/33906/info The Linux kernel is prone to an origin-validation weakness when dealing with signal handling. This weakness occurs when a privileged process calls attacker-supplied processes as children. Attackers may exploit this to send arbitrary signals t...

Linux Kernel 2.6.x - Cloned Process CLONE_PARENT Local Origin Validation

Linux Kernel 2.6.x - Cloned Process CLONEPARENT Local Origin Validation / source: https://www.securityfocus.com/bid/33906/info The Linux kernel is prone to an origin-validation weakness when dealing with signal handling. This weakness occurs when a privileged process calls attacker-supplied...

SECOBJADV-2008-03.2: PartyGaming PartyPoker Malicious Update Vulnerability

====================================================================== = Security Objectives Advisory SECOBJADV-2008-03.2 = ====================================================================== PartyGaming PartyPoker Malicious Update Vulnerability...

[Full-disclosure] CheckPoint VPN-1 UTM Edge Cross Site Request Forgery vulnerability

Louhi Networks Oy -= Security Advisory =- Advisory: Checkpoint VPN-1 UTM Edge Cross Site Request Forgery Release Date: 2007/06/26 Last Modified: 2007/06/26 Authors: Henri Lindberg, Associate of ISC? [email protected] Jussi Vuokko, CISSP [email protected] Application: Checkpoint VPN-1 Ed...

CVE-2006-4661

AOL ICQ Toolbar 1.3 for Internet Explorer toolbaru.dll does not properly validate the origin of the configuration web page options2.html, which allows user-assisted remote attackers to provide a web page that contains disguised checkboxes that trick the user into reconfiguring the toolbar...