333 matches found
WordPress Anti-CSRF令牌安全绕过漏洞
Bugtraq ID: 53280 CVE ID：CVE-2012-1936 WordPress是一款使用PHP语言开发的内容管理系统。 WordPress anti-CSRF令牌安全特性存在设计错误，攻击者可以利用漏洞绕过安全限制，执行跨站请求伪造攻击。 由于anti-CSRF令牌wpnonce, wpnoncecreate-user, ajaxnonce, wpnonce-custom-background-upload,...
WordPress 3.3.1 - Multiple CSRF Vulnerabilities
WordPress version 3.3.1 is prone to a multiple cross site request forgery vulnerabilities. These vulnerabilities are caused by a security flaw in anti-CSRF token wpnonce, wpnoncecreate-user, ajaxnonce, wpnonce-custom-background-upload, wpnonce-custom-header-upload generation. Multiple CSRF allow ...
WordPress 3.3.1 - Multiple Cross-Site Request Forgery Vulnerabilities
WordPress 3.3.1 - Multiple Cross-Site Request Forgery Vulnerabilities +---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Wordpress 3.3.1 Multiple CSRF Vulnerabilities Date : 19-03-20...
WordPress 3.3.1 Cross Site Request Forgery
+---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Wordpress 3.3.1 Multiple CSRF Vulnerabilities Date : 19-03-2012 Author : Ivano Binetti http://www.ivanobinetti.com Software link :...
SMF 2.0 / 1.1.14 XSRF Filter Bypass
Summary The img BBCode tag anti-CSRF filter can be bypassed due to incorrect parsing of the 'action' variable; because of this it is possible to successfully execute CSRF. Description Software: Simple Machines Forum SMF Versions: SMF 2.0 / SMF 1.1.14 Publication date: 2011-08-23 Impact: Cross Sit...
Kusaba X <= 0.9.1 Multiple Vulnerabilities
Exploit for php platform in category web applications KusabaX XSS and CSRF Vulnerabilites Product: KusabaX and various Futaba channels clone Vendor site: http://kusabax.cultnet.net/ Affected versions: KusabaX " ----------------------------------------------------- Attackers can exploit these...
PHP-Nuke 8.x <= Cross Site Request Forgery (CSRF) / Anti-CSRF Bypass Vulnerability
PHP-Nuke 8.x = Cross Site Request Forgery CSRF / Anti-CSRF Bypass Vulnerability 1. OVERVIEW The PHP-Nuke version 8.x and lower versions are vulnerable to Cross Site Request Forgery CSRF because its Anti-CSRF mechanism Referer Check is found to be broken. 2. BACKGROUND PHP-Nuke is a Web Portal...
PHP-Nuke 8.x Cross Site Request Forgery
PHP-Nuke 8.x = Cross Site Request Forgery CSRF / Anti-CSRF Bypass Vulnerability 1. OVERVIEW The PHP-Nuke version 8.x and lower versions are vulnerable to Cross Site Request Forgery CSRF because its Anti-CSRF mechanism Referer Check is found to be broken. 2. BACKGROUND PHP-Nuke is a Web Portal...
Drupal 5.x, 6.x <= Stored Cross Site Scripting Vulnerability
========================================================================== Drupal 5.x, 6.x = Stored Cross Site Scripting Vulnerability ========================================================================== 1. OVERVIEW Drupal 5.x and 6.x are currently vulnerable to Stored Cross Site Scripting...
Apache Archiva 1.0 < 1.3.1 - Cross-Site Request Forgery
ANATOLIA SECURITY ADVISORY -------------------------------------- ADVISORY INFO + Title: Apache Archiva Cross-site Request Forgery Vulnerability + Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-001.txt + Advisory ID: 2010-001 + Versions: Archiva 1.0 to 1.3.1 + Date: 29/09/2010 +...
Facebook.com Cross Site Request Forgery / Cross Site Scripting
Facebook is a social networking website with the second highest number of visits worldwide, and over 500 million active users. Our team recently performed a quick security audit of the main Facebook site along with its mobile versions. Here are the full details of our findings. I. DESCRIPTION OF...
CVE-2008-6975
Multiple cross-site request forgery CSRF vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the pingip parameter; 2 change the administrative credentials via the httpusername and...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the pingip parameter; 2 change the administrative credentials via the httpusername and...