Cross site request forgery (csrf)

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...

CVE-2019-13376

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...

PT-2019-13299

Name of the Vulnerable Software and Affected Versions phpBB version 3.2.7 Description The issue allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature, leading to stored XSS due to CSRF Token Hijacking. Recommendations For phpBB version...

Misskey Cross-Site Scripting Vulnerability

Misskey is a micro-blogging platform. A cross-site scripting vulnerability exists in versions of Misskey prior to 10.102.4 that can be exploited by an attacker to hijack user tokens...

CVE-2019-1020010

Misskey before 10.102.4 allows hijacking a user's token...

CVE-2019-1020010

Misskey before 10.102.4 allows hijacking a user's token...

CVE-2019-1020010

Misskey before 10.102.4 is affected by a vulnerability that allows hijacking a user’s token. Technical sources describe this as a cross‑site scripting flaw affecting Misskey versions prior to 10.102.4, with token theft as the impact. Mitigation: upgrade to 10.102.4 or later. The CVE entry itself ...

CVE-2019-1020010

Misskey before 10.102.4 allows hijacking a user's token...

PT-2019-11626

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 10.102.4 Description: The issue allows for the hijacking of a user's token, which could lead to unauthorized access. Recommendations: For versions prior to 10.102.4, update to version 10.102.4 or later to resolve the...

CVE-2019-1020010: Improper Neutralization of Input During Web Page Generation

Misskey before 10.102.4 allows hijacking a user's token...

CVE-2019-3868

CVE-2019-3868 affects Keycloak up to v6.0.0, enabling the end-user token (access/id token) to be used as the browser session cookie for OIDC, allowing session hijacking if an attacker can access the service provider backend. Red Hat advisories list this as a featured fix under Red Hat Single Sign...

CVE-2018-0229

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...

CVE-2018-0229

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...

IP Board 3.x - CSRF Token hjiacking

No description provided by source. Title: IP Board 3.x CSRF - Token hjiacking Date: 03.09.14 Version: = 3.4.6 Vendor: invisionpower.com Author: Piotr S. Video-PoC: https://www.youtube.com/watch?v=G5P21TA4DjY 1 Introduction Latest and propabbly previous IPB verions suffers on vulnerability, which...

IP Board 3.x CSRF Token Theft

Title: IP Board 3.x CSRF - Token hjiacking Date: 03.09.14 Version: = 3.4.6 Vendor: invisionpower.com Author: Piotr S. Video-PoC: https://www.youtube.com/watch?v=G5P21TA4DjY 1 Introduction Latest and propabbly previous IPB verions suffers on vulnerability, which allows attacker to steal CSRF token...

Invision Power Board (IP.Board) 3.x - Cross-Site Request Forgery / Token Hjiacking

Title: IP Board 3.x CSRF - Token hjiacking Date: 03.09.14 Version: = 3.4.6 Vendor: invisionpower.com Author: Piotr S. Video-PoC: https://www.youtube.com/watch?v=G5P21TA4DjY 1 Introduction Latest and propabbly previous IPB verions suffers on vulnerability, which allows attacker to steal CSRF token...

IP Board 3.x CSRF - Token hjiacking Vulnerability

Usage Info Latest and propabbly previous IPB verions suffers on vulnerability, which allows attacker to steal CSRF token of specific user. Function, which allows users to share forum links, does not properly sanitize user input. Mentioned token is attached in request as GET parameter, so it's abl...

Microsoft Office 2013 Token Hijacking Information Disclosure (MS13-104; CVE-2013-5054)

An information disclosure vulnerability has been reported in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office handles specially crafted responses. A remote attacker can exploit this issue by enticing a victim to open an Office file hosted on a malicious website...

CVE-2013-5054

Microsoft Office 2013 and 2013 RT allows remote attackers to discover authentication tokens via a crafted response to a file-open request for an Office file on a web site, as exploited in the wild in 2013, aka "Token Hijacking Vulnerability."...

Design/Logic Flaw

Microsoft Office 2013 and 2013 RT allows remote attackers to discover authentication tokens via a crafted response to a file-open request for an Office file on a web site, as exploited in the wild in 2013, aka "Token Hijacking Vulnerability."...