945 matches found
Simple Machines Forum <= 2.0 RC4 Sesc theft (XSRF)
Exploit for php platform in category web applications Exploit Title: Simple Machines Forum 0day.today 2018-01-01...
Adobe ColdFusion Multiple Vulnerabilities (APSB11-14) (credentialed check)
The version of Adobe ColdFusion running on the remote Windows host is affected by an unspecified cross-site request forgery XSRF vulnerability and a denial of service DoS vulnerably. Versions 8, 8.0.1, 9, and 9.0.1 are affected. A remote attacker can exploit the XSRF vulnerability by tricking a...
Web Sudo should be able to be subverted for non browsers (eg scripts) via a HTTP header
We do this for XSRF protection. Basically you should be able to subvert the web sudo mechanism via a HTTP header. This posts shows the use case https://answers.atlassian.com/questions/1273/jira-jelly-runner-via-cron-in-v4-3-4 I believe it just as secure since web sudo is really design to stop som...
Web Sudo should be able to be subverted for non browsers (eg scripts) via a HTTP header
We do this for XSRF protection. Basically you should be able to subvert the web sudo mechanism via a HTTP header. This posts shows the use case https://answers.atlassian.com/questions/1273/jira-jelly-runner-via-cron-in-v4-3-4 I believe it just as secure since web sudo is really design to stop som...
Web Sudo should be able to be subverted for non browsers (eg scripts) via a HTTP header
We do this for XSRF protection. Basically you should be able to subvert the web sudo mechanism via a HTTP header. This posts shows the use case https://answers.atlassian.com/questions/1273/jira-jelly-runner-via-cron-in-v4-3-4 I believe it just as secure since web sudo is really design to stop som...
logout.action is not protected against XSRF
This is a duplicate of CONF-21758. Please only resolve this ticket when CONF-21758 is fixed...
logout.action is not protected against XSRF - CVE-2012-6342
Cross-site request forgery CSRF vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators, for requests that logout the user via a comment...
logout.action is not protected against XSRF - CVE-2012-6342
Cross-site request forgery CSRF vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators, for requests that logout the user via a comment...
subrion <= XSRF/CSRF (Change Admin Password)
Exploit for php platform in category web applications ===================================================================== . . . . | | ||/ | || | / / \ / /\ | | / | \ \ | |/ | \ / | || | // | / // | \ /\ | /|//|||| |\ | / /|| / Exploit-ID is the Exploit Information Disclosure Web :...
Admin JSPs don't have XSRF protection
As well as a number of XSS bugs which were recently fixed in CONF-22568, the JSPs contained in Confluence don't support the same XSRF protection which our actions use. We should convert this functionality over to actions and only use JSPs to deliver patches to customers, not for proper...
Admin JSPs don't have XSRF protection
As well as a number of XSS bugs which were recently fixed in CONF-22568, the JSPs contained in Confluence don't support the same XSRF protection which our actions use. We should convert this functionality over to actions and only use JSPs to deliver patches to customers, not for proper...
Admin JSPs don't have XSRF protection
As well as a number of XSS bugs which were recently fixed in CONF-22568, the JSPs contained in Confluence don't support the same XSRF protection which our actions use. We should convert this functionality over to actions and only use JSPs to deliver patches to customers, not for proper...
SEO Ecommerce(Shopping)<= XSRF/CSRF Vulnerabilities
Exploit for php platform in category web applications ===================================================================== . . . . | | ||/ | || | / / \ / /\ | | / | \ \ | |/ | \ / | || | // | / // | \ /\ | /|//|||| |\ | / /|| / Exploit-ID is the Exploit Information Disclosure Web :...
ApPHP Shopping Cart <= XSRF (Change Admin Password)
Exploit for php platform in category web applications ================================================================================= . . . . | | ||/ | || | / / \ / /\ | | / | \ \ | |/ | \ / | || | // | / // | \ /\ | /|//|||| |\ | / /|| / Exploit-ID is the Indonesian Exploit Archive Web...
PHP Inventory XSRF Vulnerabelity
Exploit for php platform in category web applications ================================================================================= . . . . | | ||/ | || | / / \ / /\ | | / | \ \ | |/ | \ / | || | // | / // | \ /\ | /|//|||| |\ | / /|| / Exploit-ID is the Indonesian Exploit Archive Web...
eFront enterprise <= XSRF (Add admin/change admin passwd)
Exploit for php platform in category web applications ================================================================================= . . . . | | ||/ | || | / / \ / /\ | | / | \ \ | |/ | \ / | || | // | / // | \ /\ | /|//|||| |\ | / /|| / Exploit-ID is the Indonesian Exploit Archive Web...
eFront Community++ <= XSRF (Add admin/change admin passwd)
Exploit for php platform in category web applications ================================================================================= . . . . | | ||/ | || | / / \ / /\ | | / | \ \ | |/ | \ / | || | // | / // | \ /\ | /|//|||| |\ | / /|| / Exploit-ID is the Indonesian Exploit Archive Web...
eFront Educational <=XSRF (Add admin/change admin passwd)
Exploit for php platform in category web applications ================================================================================= . . . . | | ||/ | || | / / \ / /\ | | / | \ \ | |/ | \ / | || | // | / // | \ /\ | /|//|||| |\ | / /|| / Exploit-ID is the Indonesian Exploit Archive Web...
Security Alert : vBulletin 4.X Security SQL Injection & CSRF/XSRF Exploits available !
Security Alert : vBulletin 4.X - SQL Injection & CSRF/XSRF Exploits available ! Two Serious Security Flaws are detected in vBulletin 4.X Versions and also their Security SQL Injection & CSRF/XSRF Exploits are now also available. Impact of these Flaws: Lots of big Forums are on vBulletin 4.X...
MyLittleForum 2.2.7 Cross Site Request Forgery
Exploit Title: MyLittleForum 2.2.7 CMS XSRF Vulnerability Add new user + Author : ^Xecuti0n3r + E-mail : xecuti0n3ryahoo.com + Category : Web Apps XSRF + Demo Link : http://www.cmsagora.com/demo.php?id=118&type=2 + Demo Link2:http://demo.opensourcecms.com:80/mylittleforum/index.php + Demo Login:...