Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in usersmaint.html in KrisonAV CMS before 3.0.2 allows remote attackers to hijack the authentication of administrators for requests that create user accounts via a crafted request...

CVE-2013-2107

Cross-site request forgery CSRF vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdatemailto parameter in the mail-on-update pag...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdatemailto parameter in the mail-on-update pag...

CVE-2013-1668

The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file. Recent assessments: wchen-r7 at September 12, 2019 6:08pm UTC reported: In fact, doesn’t seem like the user shoul...

CVE-2013-2107

Cross-site request forgery CSRF vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdatemailto parameter in the mail-on-update pag...

Cisco Releases Security Advisories

Cisco has released two security advisories to address multiple product vulnerabilities, one of which may allow a remote attacker to execute arbitrary code with elevated privileges. The advisories are listed below: Cisco Wide Area Application Services Remote Code Execution Vulnerability Multiple...

CVE-2014-3453

Eval injection vulnerability in the flagimportformvalidate function in includes/flag.export.inc in the Flag module 7.x-3.0, 7.x-3.5, and earlier for Drupal allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area to admin/structure/flags/import...

CVE-2014-3760

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DAP 1150 with firmware 1.2.94 allow remote attackers to hijack the authentication of administrators for requests that 1 enable or 2 disable the DMZ in the Firewall/DMZ section via a request to index.cgi or 3 add, 4 modify, or 5...

Apple Releases Security Updates for OS X and iTunes

Apple has released updates to OS X and iTunes to address multiple vulnerabilities, some of which could allow an attacker to execute arbitrary code, obtain website credentials, or take control of the affected system. Updates are available: OS X Mavericks 10.9.3 for OS X Mavericks 10.9 to 10.9.2...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in OpenX 2.8.10, possibly before revision 82710, allow remote attackers to hijack the authentication of administrators, as demonstrated by requests that conduct directory traversal attacks via the group parameter to 1 plugin-preferences.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Add/Edit page adminmenus.php in the WP125 plugin before 1.5.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that add or edit an ad via unspecified vectors...

Directory traversal

Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. dot dot in the group parameter to 1 plugin-preferences.php or 2 plugin-settings.php in www/admin, a different vulnerability than CVE-2013-7376. NOTE: thi...

CVE-2013-3514

Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. dot dot in the group parameter to 1 plugin-preferences.php or 2 plugin-settings.php in www/admin, a different vulnerability than CVE-2013-7376. NOTE: thi...

CVE-2013-2034

Multiple cross-site request forgery CSRF vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary code or 2 initiat...

CVE-2013-3514

OpenX suffers a directory traversal vulnerability in versions before 2.8.10 revision 82710 that allows remote reading of arbitrary files via a .. in the group parameter to www/admin/plugin-preferences.php or www/admin/plugin-settings.php. The condition is described as a vulnerability distinct fro...

CVE-2012-6342

Cross-site request forgery CSRF vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators for requests that logout the user via a comment...

CVE-2013-2705

Cross-site request forgery CSRF vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings...

CVE-2011-4970

Removed by vendor...

CVE-2014-3115

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication of administrators via system/config/adminadd and other unspecified vectors...

Cisco Releases Security Advisory for WebEx Players

Cisco has released a security advisory to address multiple buffer overflow vulnerabilities in Cisco WebEx Recording Format and Advanced Recording Format Players. Successful exploitation of the vulnerabilities could cause an affected player to crash or allow a remote attacker to execute arbitrary...