CVE-2018-16887

A cross-site scripting XSS flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to...

CVE-2018-16887

CVE-2018-16887 affects the katello component of Red Hat Satellite. The flaw is a cross-site scripting (XSS) vulnerability where an attacker with privilege to create/edit organizations and locations can trigger XSS via the Subscriptions or Red Hat Repositories wizards, potentially enabling malicio...

Rockstar Games: CSRF Vulnerability on https://signin.rockstargames.com/tpa/facebook/link/

In this report, the researcher identified a Cross-Site Request Forgery vulnerability that could have allowed attackers to link a Facebook account to another user's Social Club account, and thus gain the ability to log in as the victim. We implemented an anti-CSRF token as part of the...

Cross Site Request Forgery (CSRF)

hsweb-system-oauth2-client is vulnerable to cross site request forgery CSRF. The state value which serves as an anti-CSRF token is not validated and verified for authenticated requests within the session, allowing a remote attacker to execute unwanted actions in the context of the user when the...

CVE-2018-16887

A cross-site scripting XSS flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to...

CVE-2018-16861

A cross-site scripting XSS flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and...

CVE-2018-16861

CVE-2018-16861 is a stored XSS in the Foreman component of Red Hat Satellite, exploitable when a user with privileges creates entities via Hosts, Monitor, Infrastructure, or Admin menus. The issue allows an attacker to inject scripts that run in other users’ browsers and could lead to theft of an...

CVE-2018-16861

A cross-site scripting XSS flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and...

CVE-2018-16861

A cross-site scripting XSS flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and...

Information Disclosure

omniauth-oauth2 is vulnerable to information disclosure. An insecure string comparison is used to verify the anti-CSRF string, allowing for an attacker to enumerate the anti-CSRF string through a timing attack...

Cross site request forgery (csrf)

Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc...

CVE-2018-15539

Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc...

Cockpit CMS CSRF / XSS / Path Traversal

1 Path Traversal CVE-2018-15540 It is possible to read/write/delete files or list directories by using "../" to traverse to other folders via requests to /cockpit/media/api Example of a vulnerable request: POST /cockpit/media/api HTTP/1.1 Host: 192.168.5.129 User-Agent: Mozilla/5.0 Windows NT 10....

Cross site scripting

RSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A remote, unauthenticated malicious user, with the knowledge of a target user's anti-CSRF token, could potentially exploit this vulnerability by tricking a victim...

xunfeng anti-csrf decorator cross-site request forgery vulnerability

xunfeng is a vulnerability rapid response and asset scanning system for enterprise intranets. anti-csrf decorator is one of the CSRF processing components. The anti-csrf decorator in xunfeng version 0.2.0 has a cross-site request forgery vulnerability that originates from the views/lib/AntiCSRF.p...

Cross-Site Request Forgery (CSRF)

Elefant CMS is vulnerable to cross-site request forgery CSRF. There is no validation for anti-CSRF tokens in the add user function. A remote attacker will be able to add a user account by tricking the administrator into visiting a malicious HTML page, which would perform the action on behalf of t...

Cross-Site Request Forgery (CSRF)

github.com/openshift/console is vulnerable to cross-site request forgery CSRF on proxied requests. The server did not perform verification for anti-CSRF tokens and source Origin header of requests. This would allow an attacker to submit requests on behalf of authenticated users via a specially...

Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities

Exploit for php platform in category web applications ======================================================================= title: SQL Injection, XSS & CSRF vulnerabilities product: Pimcore vulnerable version: 5.2.3 and below fixed version: 5.3.0 CVE number: CVE-2018-14057, CVE-2018-14058,...

CVE-2013-7464

In csrf-magic before 1.0.4, if $GLOBALS'csrf''secret' is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used...

CVE-2013-7464

In csrf-magic before 1.0.4, if $GLOBALS'csrf''secret' is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used...