CVE-2017-14957

Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator, an attacker can for example change global settings or create/delete posts. It is also possible to execute JavaScript against...

simpleCE Cross-Site Request Forgery Vulnerability

simpleCE is a simple content management system with a front-end editor mode . A cross-site request forgery vulnerability exists in simpleCE, which allows attackers to add an administrator account via index.php/user/new URI or change its settings via index.php/user/1 URI, including its password...

Security Bypass Vulnerability in Multiple Samsung Phones (CNVD-2017-07192)

Samsung SM-G920F Galaxy S6 and others are smartphones released by the South Korean company Samsung Samsung. A security bypass vulnerability exists in several Samsung phones. An attacker can exploit the vulnerability to modify Android settings with the help of AT access...

nodCMS - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title : nodcms Cross Site Request Forgery Author : Ashiyane Digital Security Team Google Dork : - Date : 29/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.nodcms.com/en Software link :...

ASUS RP-AC52 contains multiple vulnerabilities

Overview The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to cross-site request forgery and command injection. Description CWE-352:Cross-Site Request ForgeryCSRF- CVE-2016-6557 The RP-AC52 web interface does not sufficiently verify whether a valid reque...

Moxa ioLogik E1200 Series Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-287-05 Moxa ioLogik E1200 Series Vulnerabilities that was published October 13, 2016, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 4 -------- Alexandru Ariciu of Applied Risk has identified...

CVE-2016-1191

Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified vectors...

CVE-2016-1191

CVE-2016-1191 refers to a directory traversal vulnerability in Cybozu Garoon’s Files function (versions 3.x–4.2.1 before 4.2.1). The underlying issue allows an unauthenticated, remote attacker to change settings via the Files component. Affected products: Cybozu Garoon 3.0–4.2 (and related 3.x ra...

Accuenergy Acuvim II and IIR AXN-NET Module Configuration Modification Vulnerability

Accuenergy Acuvim II and IIR are Accuenergy's multi-function network power meters that provide power parameter measurement, four-quadrant power metering, and out-of-limit alarms.AXN-NET is one of the Ethernet module accessories. A security vulnerability in the AXN-NET module of the Accuenergy...

Trend Micro Deep Discovery Inspector 3.7 / 3.8 CSRF

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-DDI-CSRF.txt Vendor: ==================== www.trendmicro.com Product: ========================================= Trend Micro Deep Discovery Inspector V3.8, 3.7 Deep...

CVE-2015-8361: Services exposed without authentication Vulnerability

Bamboo exposed services without first performing authentication checks. Attackers can use this vulnerability to extract confidential information from Bamboo, modify certain settings and manage build agents. To exploit this issue, attackers need to be able to access the Bamboo JMS port. Affected...

CVE-2015-8361: Services exposed without authentication Vulnerability

Bamboo exposed services without first performing authentication checks. Attackers can use this vulnerability to extract confidential information from Bamboo, modify certain settings and manage build agents. To exploit this issue, attackers need to be able to access the Bamboo JMS port. Affected...

Cross site request forgery (csrf)

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

CVE-2015-5640

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

CVE-2015-5991

Cross-site request forgery CSRF vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone PLDT SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to hijack the authentication of administrators for requests that perfo...

Design/Logic Flaw

Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and modify settings via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2953...

CVE-2015-2958

The CVE-2015-2958 entry concerns Igreks MilkyStep Light (0.94 and earlier) and MilkyStep Professional (1.82 and earlier), where remote attackers could bypass access restrictions and modify administrator credentials via unspecified vectors. This vulnerability is distinct from CVE-2015-2952 and CVE...

WordPress Quasar Theme 1.9.1 Privilege Escalation Vulnerability

WordPress Quasar Theme version 1.9.1 suffers from a privilege escalation vulnerability. ------------------------------------------------------------------------------ WordPress Quasar Theme Previlege Escalation ------------------------------------------------------------------------------ - Theme...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in diafan.CMS before 5.1 allow remote attackers to hijack the authentication of administrators for requests that 1 modify articles via a savepost action to admin/news/saveNEWSID/, 2 modify settings via a savepost action to admin/site/save2/...

CVE-2014-2374

The CVE-2014-2374 entry concerns the AXN-NET Ethernet module (v3.04) for the Accuenergy Acuvim II. The vulnerability arises from client-side JavaScript validation on the module’s web server, enabling authenticated? or remote attackers to bypass authentication and disclose passwords and modify set...