Nagios XI 2009R1.2B Multiple CSRF

Advisory Information Advisory ID: NGENUITY-2010-006 Date published: Aug. 7, 2010 Class: Cross-Site Request Forgery CSRF Software Description Nagios XI is the commercial / enterprise version of the open source Nagios project. Vulnerability Description Nagios XI 2009R1.2B is vulnerable to multiple...

Nagios XI - Multiple Cross-Site Request Forgery Vulnerabilities

source: https://www.securityfocus.com/bid/42322/info Nagios XI is prone to multiple cross-site request-forgery vulnerabilities because the application fails to properly validate HTTP requests. Successful exploit requires that the 'nagiosadmin' be logged into the web interface. Attackers can explo...

DEBIAN-CVE-2010-1648

Cross-site request forgery CSRF vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that 1 create accounts or 2 reset passwords, related to the Special:Userlogin form...

mediawiki -- two security vulnerabilities

Two security vulnerabilities were discovered: Noncompliant CSS parsing behaviour in Internet Explorer allows attackers to construct CSS strings which are treated as safe by previous versions of MediaWiki, but are decoded to unsafe strings by Internet Explorer. A CSRF vulnerability was discovered ...

CVE-2010-1910

Consona password-reset vulnerability CVE-2010-1910 affects Consona Live Assistance, Dynamic Agent, and Subscriber Assistance. The Forgot Password feature allows remote reset of accounts with blank Hint questions/answers by submitting empty values for both fields, enabling password changes without...

CVE-2010-1910

The Forgot Password implementation in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to reset passwords of accounts with blank Hint questions and Hint answers by sending an empty value for each of these two Hint fields...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in AlegroCart 1.1 allows remote attackers to hijack the authentication of the administrator for requests that reset the administrator password via a POST to admin/ with an update action...

CVE-2010-1611

Cross-site request forgery CSRF vulnerability in AlegroCart 1.1 allows remote attackers to hijack the authentication of the administrator for requests that reset the administrator password via a POST to admin/ with an update action...

CVE-2010-1611

CVE-2010-1611 : In AlegroCart 1.1, a cross-site request forgery (CSRF) vulnerability could allow remote attackers to hijack the administrator’s session and reset the administrator password via a POST to the admin/ endpoint with an update action. The provided documents confirm the affected product...

CVE-2010-1611

Cross-site request forgery CSRF vulnerability in AlegroCart 1.1 allows remote attackers to hijack the authentication of the administrator for requests that reset the administrator password via a POST to admin/ with an update action...

Joomla Password Reset Weakness and Session Fixation Vulnerability

No description provided by source. A weakness and a vulnerability have been reported in Joomla, which can be exploited by malicious people to disclose sensitive information and conduct session fixation attacks. 1 The weakness is caused due to password reset tokens being stored in plain text in th...

Memorial Web Site Script Password Reset / Insecure Cookie

----------------------------------------------------------------------- Memorial Web Site Script -- Reset Password & Insecure Cookie Handling ----------------------------------------------------------------------- Author : Chip D3 Bi0s Email : chipdebiosalt+64gmail.com Where : From Remote Group :...

Memorial Web Site Script --> Reset Password & Insecure Cookie Handling

Exploit for php platform in category web applications ====================================================================== Memorial Web Site Script -- Reset Password & Insecure Cookie Handling ======================================================================...

Memorial Web Site Script - Reset Password Insecure Cookie Handling

Memorial Web Site Script - Reset Password Insecure Cookie Handling ----------------------------------------------------------------------- Memorial Web Site Script -- Reset Password & Insecure Cookie Handling ----------------------------------------------------------------------- Author : Chip D3...

joomla -- multiple vulnerabilities

Joomla! reported the following vulnerabilities: If a user entered a URL with a negative query limit or offset, a PHP notice would display revealing information about the system.. The migration script in the Joomla! installer does not check the file type being uploaded. If the installation...

Advisory 01/2010: MyBB Password Reset Email BCC: Injection Vulnerability

SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: MyBB Password Reset Email BCC: Injection Vulnerability Release Date: 2010/04/13 Last Modified: 2010/04/13 Author: Stefan Esser stefan.esseratsektioneins.de Application: MyBB = 1.4.11 Severity: An email injection vulnerability i...

Advisory 02/2010: MyBB Password Reset Weak Random Numbers Vulnerability

SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: MyBB Password Reset Weak Random Numbers Vulnerability Release Date: 2010/04/13 Last Modified: 2010/04/13 Author: Stefan Esser stefan.esseratsektioneins.de Application: MyBB = 1.4.11 Severity: Usage of weak random number...

CVE-2010-0713

Multiple cross-site request forgery CSRF vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack the authentication of an administrator for 1 requests that reset user passwords via zport/dmd/ZenUsers/admin, and 2 requests that change user commands, which...

Infested Torrent Sites Caused Twitter PW Reset

Twitter revealed more details about the phishing attacks that caused the company to reset the passwords on some user accounts Feb. 2. Read the full article. eWEEK...

ExtMail1.2 邮件系统跨站脚本漏洞（3P）

北洋贱队2009.12.31首发 Extmail 是一个以perl语言编写，面向大容量/ISP级应用，免费的高性能Webmail软件。 最新版本为1.2，检测出三出处跨站漏洞。 1.免费新用户注册的"signup.cgi"对‘domain’参数未进行参数过滤，构建恶意脚本代码作为参数数据，并诱使用户访问恶意链接，可触发恶意脚本代码在目标用户浏览器上执行，导致敏感信息泄漏。 demo:http://demo.extmail.org/extman/cgi/signup.cgi?domain=%22%3E%3Ciframe%20src=http://www.gohack.org%3E...