Adobe Coldfusion 8 XSS / XSRF

http://www.dsecrg.com/pages/vul/show.php?id=122 Digital Security Research Group DSecRG Advisory DSECRG-09-022 Application: Adobe Coldfusion 8 Versions Affected: Adobe Coldfusion 8 Vendor URL: http://adobe.com Bugs: Multiple Linked XSS,XSRF Exploits: YES Reported: 12.01.2009 Vendor response:...

[DSECRG-09-022] Adobe Coldfusion 8 Multiple Linked XSS Vulnerabilies

http://www.dsecrg.com/pages/vul/show.php?id=122 Digital Security Research Group DSecRG Advisory DSECRG-09-022 Application: Adobe Coldfusion 8 Versions Affected: Adobe Coldfusion 8 Vendor URL: http://adobe.com Bugs: Multiple Linked XSS,XSRF Exploits: YES Reported: 12.01.2009 Vendor response:...

Uploading large fonts for PDF export fails with XSRF error

When uploading souizhs.ttf font that we use due to its comprehensive UTF8 support, I'm getting XSRF validation error: quote Your request could not be processed because a required security token was not present in the request. You may need to re-submit the form or reload the page. quote I tried...

Uploading large fonts for PDF export fails with XSRF error

When uploading souizhs.ttf font that we use due to its comprehensive UTF8 support, I'm getting XSRF validation error: quote Your request could not be processed because a required security token was not present in the request. You may need to re-submit the form or reload the page. quote I tried...

Uploading large fonts for PDF export fails with XSRF error

When uploading souizhs.ttf font that we use due to its comprehensive UTF8 support, I'm getting XSRF validation error: quote Your request could not be processed because a required security token was not present in the request. You may need to re-submit the form or reload the page. quote I tried...

Multiple Flaws in Huawei SmartAX MT880 [was: Multiple Flaws in Huawei D100]

Description: Huawei MT880 is a device offered by the algerian telecom operator - FAWRI, to provide ADSL Internet connexion and it's already widely in use. Overview: Huawei MT880 firmware and its default configuration has flaws, which allows LAN users to gain unauthorized full access to device. He...

Huawei MT800 Cross Site Request Forgery

Description: Huawei MT880 is a device offered by the algerian telecom operator - FAWRI, to provide ADSL Internet connexion and it's already widely in use. Overview: Huawei MT880 firmware and its default configuration has flaws, which allows LAN users to gain unauthorized full access to device. He...

TinyBrowser (TinyMCE Editor File browser) 1.41.6 - Multiple Vulnerabilities

TinyBrowser TinyMCE Editor File browser 1.41.6 - Multiple Vulnerabilities ============================================================================== TinyBrowser TinyMCE Editor File browser 1.41.6 - Multiple Vulnerabilities...

TinyBrowser 1.41.6 XSS / XSRF / Creation

============================================================================== TinyBrowser TinyMCE Editor File browser 1.41.6 - Multiple Vulnerabilitis ============================================================================== Discovered by Aung Khant, YGN Ethical Hacker Group, Myanmar...

Citrix XenCenterWeb XSS / XSRF / SQL Injection

Secure Network - Security Research Advisory Vuln name: Citrix XenCenterWeb Multiple Vulnerabilities Systems affected: Citrix XenCenterWeb Systems not affected: n/a Severity: High Local/Remote: Remote Vendor URL: http://www.citrix.com Authors: Alberto Trivero [email protected] - Claudio...

CakeCMS XSRF Vulnerability

------------------- header data start ------------------- Application Name : CakeCMS Vulnerable Type : Edt USER XSRF Vuln author : MnmL Bug Researchers ------------------- header data end of ------------------- -- bug code start -- form action="SITE.COM/admin/users/edit/41" method="post"...

Campus Virtual-LMS XSRF / XSS / SQL Injection

+-----------------------------------------------------------------------------+ LMS: Campus Virtual-LMS WEB: http://campusvirtualcomputrade.cae.net Autor: Yasión Fecha: 12 jun 2009 +-----------------------------------------------------------------------------+...

Random number generator and input name linebreaks can be used to send custom data to other sites

Input names can contain line breaks when data is sent using POST. Suitable use of the random number generator can reveal predictable boundaries that will be used when sending the POST data. These can be combined to add extra boundaries into the data, containing payloads that may confuse the...

Jiraissues add icon mapping configuration is susceptible to XSS

Combined with XSRF susceptibility via CONF-15753; you can craft an attack to get elevated privileges in Confluence. !http://img.skitch.com/20090520-x5gug8e8q5snabtmm2i2kdx1p.jpg!...

Jiraissues add icon mapping configuration is susceptible to XSS

Combined with XSRF susceptibility via CONF-15753; you can craft an attack to get elevated privileges in Confluence. !http://img.skitch.com/20090520-x5gug8e8q5snabtmm2i2kdx1p.jpg!...

Jiraissues add icon mapping configuration is susceptible to XSS

Combined with XSRF susceptibility via CONF-15753; you can craft an attack to get elevated privileges in Confluence. !http://img.skitch.com/20090520-x5gug8e8q5snabtmm2i2kdx1p.jpg!...

Syhunt: A-A-S (Application Access Server) Multiple Security Vulnerabilities

Syhunt: A-A-S Application Access Server Multiple Security Vulnerabilities Advisory-ID: 200905111 Discovery Date: 3.23.2009 Release Date: 5.11.2009 Affected Applications: A-A-S 2.0.48 and possibly older versions Class: XSRF Cross Site Request Forgery Arbitrary Command Execution, Undocumented Defau...

Klinzmann A-A-S 2.0.48 XSRF Exploit

!-- AASHack 1.0 By Felipe M. Aragon Affected Versions: AAS 2.0.48 and possibly older versions This is an exploit demonstration code for the A-A-S Application Access Server index.aas job parameter XSRF vulnerability CVE-2009-1464 This script has been successfully tested on IE 7.0 and Firefox 3.08...

Klinzmann A-A-S XSRF / Code Execution

Syhunt: A-A-S Application Access Server Multiple Security Vulnerabilities Advisory-ID: 200905111 Discovery Date: 3.23.2009 Release Date: 5.11.2009 Affected Applications: A-A-S 2.0.48 and possibly older versions Class: XSRF Cross Site Request Forgery Arbitrary Command Execution, Undocumented Defau...

[DSECRG-09-020] Apache Geronimo - XSRF vulnerabilities

Original Advisory: http://dsecrg.com/pages/vul/show.php?id=120 Digital Security Research Group DSecRG Advisory DSECRG-09-020 Application: Apache Geronimo Application Server Versions Affected: 2.1 - 2.1.3 Vendor URL: http://geronimo.apache.org/ Bug: Multiple XSRF Vulnerabilities Exploits: YES...