XSRF (CSRF) in DiamondList

Vulnerability ID: HTB22517 Reference: http://www.htbridge.ch/advisory/xsrfcsrfindiamondlist.html Product: DiamondList Vendor: Hulihan Applications http://hulihanapplications.com/projects/diamondlist Vulnerable Version: 0.1.6 and Probably Prior Versions Vendor Notification: 22 July 2010...

EZ-Oscommerce 2.1 Cross Site Request Forgery / File Disclosure

==================================================== EZ-Oscommerce 2.1 File Disclosure Vulnerabilities EZ-Oscommerce 2.1 Changer Login et Mot de Passe CSRF Vulnerability ==================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0...

Outlook Web Access 2003 - Cross-Site Request Forgery

Outlook Web Access 2003 - Cross-Site Request Forgery Exploit Title: Microsoft Office Outlook Web Access for Exchange Server 2003 XSRF Vulnerability Date: 07/20/2010 Author: anonymous Tested on: Microsoft Office Outlook Web Access for Exchange Server 2003 A cross-site request forgery vulnerability...

XSRF (CSRF) in Pixie

Vulnerability ID: HTB22471 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinpixie1.html Product: Pixie Vendor: Toggle Labs Ltd http://www.getpixie.co.uk/ Vulnerable Version: 1.0.4 and Probably Prior Versions Vendor Notification: 01 July 2010 Vulnerability Type: CSRF Cross-Site Request Forgery...

XSRF (CSRF) in Pixie

Vulnerability ID: HTB22470 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinpixie.html Product: Pixie Vendor: Toggle Labs Ltd http://www.getpixie.co.uk/ Vulnerable Version: 1.0.4 and Probably Prior Versions Vendor Notification: 01 July 2010 Vulnerability Type: CSRF Cross-Site Request Forgery...

TEHTRI-Security released 13 0days against web tools used by evil attackers

Gents, As announced in recent emails here, we have just released 13 0days and new offensive concepts against most of the tools currently used by web attackers, like web shells, exploit packs, etc, during our new talk at SyScan Singapore 2010 : http://www.syscan.org/Sg/speakers.html012 We have giv...

Simple Machines Forum 2.0 RC3 Cross Site Request Forgery

Exploit Title: Simple Machines Forum = 2.0 RC3 Sesc theft XSRF Date: 09-06-2010 Author: Xianur0 Software Link: http://download.simplemachines.org/ Version: =2.0 RC3 Tested on: 1.1.11 & 2.0 RC3 Vale, este "bug" es simple, y a decir verdad me parese bastante estupido, pero bueno... xD... El SMF en...

XSRF (CSRF) in CuteSITE CMS

Vulnerability ID: HTB22395 Reference: http://www.htbridge.ch/advisory/xsrfcsrfincutesitecms.html Product: CuteSITE CMS Vendor: AMT Company Vulnerable Version: 1.5.0 and Probably Prior Versions Vendor Notification: 20 May 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status: Not Fixed,...

Accoria Rock Web Server contains multiple vulnerabilities

Overview Accoria Web Server contains multiple vulnerabilities that collectively could allow an attacker to execute commands through the administration interface. Description The Accoria web server, also known as Rock Web Server, contains several cross-site scripting XSS and cross-site request...

XSRF (CSRF) in ocPortal

Vulnerability ID: HTB22369 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinocportal.html Product: ocPortal Vendor: ocProducts Ltd Vulnerable Version: 4.3.2 and Probably Prior Versions Vendor Notification: 05 May 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status: Not Fixed, Vend...

XSRF (CSRF) in NPDS REvolution

Vulnerability ID: HTB22367 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinnpdsrevolution.html Product: NPDS REvolution Vendor: NPDS Vulnerable Version: REvolution 10.02 and Probably Prior Versions Vendor Notification: 06 May 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status:...

Abyss Web Server X1 XSRF

Exploit for php platform in category web applications ======================== Abyss Web Server X1 XSRF ======================== Abyss Web Server X1 XSRF A cross-site request forgery vunlerability in the Abyss Web Server X1 management console can be exploited to change both the username and...

XSRF (CSRF) in eliteCMS

Vulnerability ID: HTB22355 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinelitecms.html Product: eliteCMS Vendor: Elite Graphix Vulnerable Version: 1.01 and Probably Prior Versions Vendor Notification: 19 April 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status: Not Fixed, Vend...

KubeBlog XSRF Vulnerabilities

Exploit for php platform in category web applications ============================= KubeBlog XSRF Vulnerabilities ============================= ======================================================================================== | Title : KubeBlog XSRF Vuln. | Author : The.Morpheus | email :...

osCommerce 3.0a5 Cross Site Request Forgery / Cross Site Scripting / Local File Inclusion

Multiple Vulnerabilities in osCommerce Vendor SW: osCommerce Version: 3.0a5 but possible all versions Vendor URL: www.oscommerce.com Tested on: Ubuntu Server 9.10 Category: Webapps/0day Date: 30 Apr 2010 Author: Alberto Fontanella Author WEB: ictsec.wordpress.com Author EMAIL: itsicurezzayahoo.it...

New-CMS - Multiple Vulnerabilities

New-CMS - Multiple Vulnerabilities Multiple Vulnerability in New-CMS Vendor SW: New-CMS Version: 1.08 but possible all versions Vendor URL: www.new-cms.org Tested on: Ubuntu Server 9.10 Category: Webapps/0day Date: 17 Feb 2010 Author: Alberto "fulgur" Fontanella Author URL: ictsec.wordpress.com...

New-CMS - Multiple Vulnerabilities

Multiple Vulnerability in New-CMS Vendor SW: New-CMS Version: 1.08 but possible all versions Vendor URL: www.new-cms.org Tested on: Ubuntu Server 9.10 Category: Webapps/0day Date: 17 Feb 2010 Author: Alberto "fulgur" Fontanella Author URL: ictsec.wordpress.com Author EMAIL: itsicurezzayahoo.it 1 ...

New-CMS v1.08 Multiple Vulnerability

Exploit for php platform in category web applications ==================================== New-CMS v1.08 Multiple Vulnerability ==================================== Vendor SW: New-CMS Version: 1.08 but possible all versions Vendor URL: www.new-cms.org Tested on: Ubuntu Server 9.10 Category:...

osCommerce v3.0a5 Multiple Vulnerabilities

Exploit for php platform in category web applications ========================================== osCommerce v3.0a5 Multiple Vulnerabilities ========================================== Vendor SW: osCommerce Version: 3.0a5 but possible all versions Vendor URL: www.oscommerce.com Tested on: Ubuntu...

JIRA is vulnerable to clickjacking attacks

A clickjacking attack on JIRA would most likely take the form of a third-party site, containing an invisible iframe on top of an unrelated page. The iframe would contain a page in JIRA. The victim would believe he was clicking on the other site but would actually be clicking in JIRA and performin...