CVE-2012-5607

The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack."...

JON: Unapproved agents can hijack an approved agent's endpoint by using a null security token

Red Hat JBoss Operations Network JON before 2.4.2 and 3.0.x before 3.0.1 allows remote attackers to hijack agent sessions via an agent registration request without a security token...

Important: Red Hat Security Advisory: JBoss Operations Network 3.0.1 update

JBoss Operations Network 3.0.1, which fixes multiple security issues and several bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

Zen Cart 'path_to_admin/product.php'跨站请求伪造漏洞

Bugtraq ID: 51968 CVE ID：CVE-2011-4403 Zen Cart是一款免费的购物车软件。 Zen Cart管理控制面板存在跨站请求伪造漏洞，攻击者提交特制表单，可以管理员权限删除或禁用产品等。 0 Zen Cart 1.3.9h 厂商解决方案 目前没有详细解决方案提供： http://www.zen-cart.com/ form name="products" action=" http://www.mysite.com/pathtoadmin/product.php?action=deleteproductconfirm"; method="post"...

Zen-Cart 1.3.9h Cross Site Request Forgery

Advisory Information Title: Zen-Cart Admin CSRF/XSRF - Delete / Disable Products Date published: 2012-02-10 01:59:45 AM upSploit Ref: UPS-2011-0018 CVE REF: CVE-2011-4403 Advisory Summary An attacker can force an administrator to delete or disable products from within his store. Vendor Zen-Cart...

Zen Cart 1.3.9h - '/path_to_admin/product.php' Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/51968/info Zen Cart is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also...

JON: Unapproved agents can hijack an approved agent's endpoint by using a null security token

Red Hat JBoss Operations Network JON before 2.4.2 and 3.0.x before 3.0.1 allows remote attackers to hijack agent sessions via an agent registration request without a security token...

http-joomla-brute NSE Script

Performs brute force password auditing against Joomla web CMS installations. This script initially reads the session cookie and parses the security token to perfom the brute force password auditing. It uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are...

Novell ZENworks Desktop Management Installation Service Remote Information Disclosure Vulnerability

This vulnerability allows remote attackers to impersonate valid users in vulnerable installations of Novell ZENworks Desktop Management. Authentication is not required to exploit this vulnerability. The specific flaw exists due to an information leak when querying the AWSI service which listens b...

Fedora Core 10 FEDORA-2009-8797 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory FEDORA-2009-8797. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C ...

Fedora Core 10 FEDORA-2009-8797 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory FEDORA-2009-8797. OpenVAS Vulnerability Test $Id: fcore20098797.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-8797 squirrelmail Authors: Thomas Reinke Copyright: Copyright...

Fedora 10 : squirrelmail-1.4.19-2.fc10 (2009-8797)

Implemented page referal verification mechanism. Secunia Advisory SA34627 - Implemented security token system. Secunia Advisory SA34627 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Uploading large fonts for PDF export fails with XSRF error

When uploading souizhs.ttf font that we use due to its comprehensive UTF8 support, I'm getting XSRF validation error: quote Your request could not be processed because a required security token was not present in the request. You may need to re-submit the form or reload the page. quote I tried...

Grumble crooked CSRF vulnerability-vulnerability warning-the black bar safety net

Notice, this vulnerability has been submitted to grumble crooked official processing 2009-02-05, in the present case only as a technical study. Thus vulnerability is caused by all the consequences, I do not take any responsibility. Participate in the group“Jing Wu door”Security Summit, 80sec team...

vBulletin 3.7.3 Visitor Message XSS/XSRF + worm Exploit

Exploit for unknown platform in category web applications ======================================================= vBulletin 3.7.3 Visitor Message XSS/XSRF + worm Exploit ======================================================= / ----------------------------- Author = Mx Title = vBulletin 3.7.3...

Microsoft Windows NT 4.0SP1SP2SP3SP4 NT 3.5.1SP1SP2SP3SP4SP5 - Screensaver

Microsoft Windows NT 4.0SP1SP2SP3SP4 NT 3.5.1SP1SP2SP3SP4SP5 - Screensaver source: https://www.securityfocus.com/bid/474/info When the computer is idle for the set time period user definable Winlogon.exe starts the screensaver. The screen saver process is selectable by the user. Winlogon.exe uses...