Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cisco MediaSense 10.51 and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu16728...

[SECURITY] Fedora 21 Update: mingw-curl-7.42.0-1.fc21

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

Legend Perl IRC Bot - Remote Code Execution

legendrce.py Legend Perl IRC Bot Remote Code Execution PoC author: Jay Turla @shipcod3 description: This is a RCE PoC for Legend Bot which has been used in the Shellshock spam October 2014. reference:...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in API features in Cisco Unified MeetingPlace 8.61.9 allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus95884...

CVE-2015-0704

CVE-2015-0704 affects Cisco Unified MeetingPlace Server (8.6(1.9)) with CSRF vulnerabilities in API features that allow remote attackers to hijack user authentication. The root cause is insufficient CSRF protections in multiple-state-changing URL API functionalities. Impact, as documented, is use...

CVE-2015-3370

Cross-site request forgery CSRF vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the authentication of users with the "nodeinvitecanmanageinvite" permission for requests that re-enable node invitations via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the authentication of users with the "nodeinvitecanmanageinvite" permission for requests that re-enable node invitations via unspecified vectors...

IBM WebSphere Portal Unspecified Reflected XSS (PI30620)

The version of IBM WebSphere Portal installed on the remote host is affected by an unspecified cross-site scripting vulnerability due to improper validation of user-supplied input. A remote attacker can exploit this flaw using a specially crafted URL to execute arbitrary script code in a user's w...

Windows exposure“redirect SMB”vulnerability, the impact of Win10, including all versions-bug warning-the black bar safety net

Recently Cylance company released a Windows System to serious vulnerability, the attacker via the exploit can steal user authentication information. The vulnerability includes the latest Windows 1 0 preview version, including all versions of Windows, as well as Adobe, Apple, Box, Oracle, Symantec...

User authentication bypass

More info at https://thelia.net/version-2-1-3-with-security-fix...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users...

CVE-2015-0905

CVE-2015-0905 affects the bBlog platform. The vulnerability is a cross-site request forgery (CSRF) that allows an attacker to hijack the authentication of arbitrary users. If a logged-in user visits a malicious page, unintended operations may be performed on behalf of that user. Affected details ...

CVE-2015-0259

OpenStack Compute Nova before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage...

CVE-2015-2759

Multiple cross-site request forgery CSRF vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint DLPe before 9.3 Patch 4 Hotfix 16 9.3.416.4 allow remote attackers to hijack the authentication of users for requests that 1 obtain sensitive information or 2 modify the database...

CVE-2015-2759

Multiple cross-site request forgery CSRF vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint DLPe before 9.3 Patch 4 Hotfix 16 9.3.416.4 allow remote attackers to hijack the authentication of users for requests that 1 obtain sensitive information or 2 modify the database...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in ClearQuest Web in IBM Rational ClearQuest 7.1.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout or insert XSS sequences...

IRCCloud: Email verification links still valid after changing it 2x

When creating a new account on IRCCloud.com the user is asked to confirm his email address. The email verification link is formatted in the following way: ircloud.com/verify-emai/userid/emailaddress/hashvalue. If the user decides to change his email address before he confirmed it, a new...

ShareLaTeX vulnerable to remote command execution and information disclosure

Overview ShareLaTeX is a server-based software allowing group collaboration on LaTeX documents. ShareLaTeX prior to version 0.1.3 has been found to be vulnerable to command injections and information disclosure. Description CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform unspecified actions via a REST API request...