PT-2017-15709

Name of the Vulnerable Software and Affected Versions Milwaukee ONE-KEY Android mobile application affected versions not specified Description The issue concerns the use of bearer tokens in the Milwaukee ONE-KEY Android mobile application. These tokens have an expiration period of one year and ca...

CVE-2017-3215

The Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of one year. This bearer token, in combination with a userid can be used to perform user actions...

IBM WebSphere Application Server Cross-Site Scripting Vulnerability (CNVD-2017-06809)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A cross-site scripting vulnerability exists in IBM WebSphere...

CVE-2017-1180

The IBM TRIRIGA Document Manager contains a vulnerability that could allow an authenticated user to execute actions they did not have access to. IBM Reference : 2001084...

CVE-2016-8917

IBM Sterling Order Management 9.2 - 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference : 2000943...

FTP Voyager Scheduler Cross-Site Request Forgery Vulnerability

FTP Voyager Scheduler is a program that starts or stops the scheduler when a user creates a directory or uploads or downloads a file by creating a task or command. A cross-site request forgery vulnerability exists in FTP Voyager Scheduler that stems from a failure to properly validate HTTP...

CVE-2016-9916

Memory leak in hw/9pfs/9p-proxy.c in QEMU aka Quick Emulator allows local privileged guest OS users to cause a denial of service host memory consumption and possibly QEMU process crash by leveraging a missing cleanup operation in the proxy backend...

PT-2016-7550

Name of the Vulnerable Software and Affected Versions SIMATIC CP 343-1 Advanced incl. SIPLUS NET variant versions prior to V3.0.53 SIMATIC CP 443-1 Advanced incl. SIPLUS NET variant versions prior to V3.2.17 SIMATIC S7-300 PN/DP CPU family incl. SIPLUS variants affected versions not specified...

IBM WebSphere eXtreme Scale Cross-Site Request Forgery Vulnerability

IBM WebSphere eXtreme Scale is a distributed caching solution. A cross-site request forgery vulnerability exists in IBM WebSphere Extreme Scale, which allows remote attackers to construct malicious URIs, trick users into parsing them, and perform malicious actions in the context of the target use...

The vulnerability of the Safari browser, which allows a hacker to track user actions

The vulnerability of the WebKit component in the Safari browser is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to remotely monitor user actions through a specially crafted website...

Contributed Systems Sidekiq Cross-Site Request Forgery Vulnerability

Contributed Systems Sidekiq is a Ruby-based background processor that provides an efficient message queuing system for Rails 3 applications. A cross-site request forgery vulnerability exists in Contributed Systems Sidekiq, which allows a remote attacker to construct a malicious URI, trick a user...

Mozilla: Local files or privileged URLs in pages can be opened into new tabs (MFSA 2015-60)

Mozilla Firefox 38.0 and Firefox ESR 38.0 allow user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions. NOTE: this vulnerability exists because of a...

Spina CMS 'spina/application_controller.rb' Cross-Site Request Forgery Vulnerability

Spina CMS is an open source content management system based on Rails development . Spina CMS suffers from a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform malicious actions...

ManageEngine EventLog Analyzer 10.0 Build 10001 - Cross-Site Request Forgery

ManageEngine EventLog Analyzer 10.0 Build 10001 - Cross-Site Request Forgery input type="hidden"...

Drupal Htaccess Module Cross-Site Request Forgery Vulnerability

Drupal is written using the PHP language open source content management framework , which consists of a content management system and PHP development framework together . A cross-site request vulnerability exists in the Drupal Htaccess Module, which allows remote attackers to construct malicious...

Microsoft Internet Explorer 5/6 JavaScript Interface Spoofing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3469/info It is reported that Microsoft Internet Explorer may permit aspects of the Internet Explorer interface to be spoofed. This could facilitate numerous attacks against users of the browser, including spoofing of bot...

dalbum 144 build 174 and earlier CSRF Vulnerabilities

No description provided by source. dalbum 144 build 174 and earlier CSRF Vulnerabilities =================================================================================== Exploit Title:dalbum 144174 and earlier CSRF Vulnerabilities Vendor: http://www.dalbum.org/ Download link...

Tencent microblogging XSS attack vulnerability-vulnerability warning-the black bar safety net

from: author:Kingthy's I believe we all know Sina Weibo in 6 on 2 8 may occurXSSattack event? That night, a large number of Sina Weibo users to automatically send tweets and automatically focus on one called“hellosamy“of the user. What exactlyXSSattacks why can have so much power for? Now many...

CVE-2008-7100

Unspecified vulnerability in DotNetNuke 4.4.1 through 4.8.4 allows remote authenticated users to bypass authentication and gain privileges via unknown vectors related to a "unique id" for user actions and improper validation of a "user identity."...

Web Server Uses Non Random Session IDs

The remote web server generates a session ID for each connection. A session ID is typically used to keep track of a user's actions while they visit a website. The remote server generates non-random session IDs. An attacker might use this flaw to guess the session IDs of other users and therefore...