Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to log out and require re-authentication...

CVE-2018-15334

A cross-site request forgery CSRF vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to log out and require re-authentication...

CVE-2018-1492

IBM Jazz Foundation products could allow a user with physical access to the system to log in as another user due to the server's failure to properly log out from the previous session. IBM X-Force ID: 140977...

The vulnerability of the weblogin_log function in the D-Link DIR-629-B1 router’s microprogramming software allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the webloginlog function /htdocs/cgibin of the D-Link DIR-629-B1 router microprogramming system is caused by buffer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or trigger a denial-of-service attack by sending a specially crafted...

CVE-2016-0318

Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 does not destroy a Session ID upon a logout action, which allows remote attackers to obtain access by leveraging an unattended workstation...

F5 Networks BIG-IP : Configuration utility CSRF vulnerability (SOL21485342)

When an authenticated Configuration utility user visits a specially crafted web page, the user's current session can be logged out and unknowingly logged in to the Configuration utility using a different user account. C Tenable Network Security, Inc. The descriptive text and package checks in thi...

Medical Study Blasts Hospitals' Security Practices

A scathing rebuke of medical professionals’ attitudes toward information security reveals nurses and doctors fumble over protocols often putting patients at risk. The revealing study, “Workarounds to Computer Access in Healthcare Organizations PDF,” offers a fascinating look behind the privacy...

Phabricator: CSRF token valid even after the session logout of a particular user

Hi, To reproduce the issue: 1 Login to your https://secure.phabricator.com account and copy your Anti CSRF token. 2 Now logout and again login after sometime. 3 Open up your burp suite to modify the request and now submit any form with your old CSRF token. The request will be completed. So let's...

Gmail Checker Plus Chrome Extension Cross Site Scripting / Cross Site Request Forgery

Gmail Checker plus Chrome extension XSS/CSRF II extension: https://chrome.google.com/extensions/detail/gffjhibehnempbkeheiccaincokdjbfe advisore:http://lostmon.blogspot.com/2010/06/gmail-checker-plus-chrome-extension.html Exploit available:yes vendor notify: NO So in this case "Google Mail Checke...

CVE-2005-3634: Undefined Security Weakness

frameset.htm in the BSP runtime in SAP Web Application Server WAS 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter...