CVE-2014-9587

CVE-2014-9587 affects Roundcube Webmail prior to version 1.0.4, exposing multiple CSRF vulnerabilities that allow remote attackers to hijack user authentication via vectors tied to address book operations, ACL, or Managesieve plugins. Public references from SUSE/OpenSUSE and Debian indicate that ...

CVE-2014-9587

Multiple cross-site request forgery CSRF vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to 1 address book operations or the 2 ACL or 3 Managesieve plugins...

CVE-2014-10014

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change the username and password of the administrator via an update action to the AdminOptions controller or...

CVE-2014-10006

Multiple cross-site request forgery CSRF vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting XSS attacks via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2...

CVE-2014-10001

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 conduct cross-site scripting XSS attacks via the i18n1name parameter in a pjActionCreate action to the...

CVE-2014-100001

Cross-site request forgery CSRF vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are obtained from...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Stark CRM 1.0 allow remote attackers to hijack the authentication of administrators for requests that add 1 an administrator via a crafted request to the admin page, 2 an agent via a crafted request to the agent page, 3 a sub-agent via a...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting XSS attacks via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2...

CVE-2014-10001

CVE-2014-10001 affects PHPJabbers Appointment Scheduler 2.0. The vulnerability set consists of CSRF flaws that enable an attacker to hijack administrator sessions for requests crafted to the application, including (1) XSS via the i18n[1][name] parameter in a pjActionCreate action targeting the pj...

CVE-2014-10014

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change the username and password of the administrator via an update action to the AdminOptions controller or...

CVE-2014-10019

Multiple cross-site request forgery CSRF vulnerabilities in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem allow remote attackers to hijack the authentication of administrators for requests that 1 change the SSID or 2 change the password via a crafted request...

CVE-2014-10027

CVE-2014-10027 affects the D-Link DAP-1360 router (firmware 2.5.4 and earlier). The issue is multiple CSRF vulnerabilities that allow remote attackers to hijack user authentication and perform MAC filter actions (change restrict mode, add, or remove MAC addresses) by crafting requests to index.cg...

CVE-2014-10008

CVE-2014-10008 (Stark CRM v1.0) is documented in connected sources as CSRF vulnerabilities that enable forged requests to admin pages (admin/agent/sub_agent/partner/client) to hijack administrator authentication and perform privileged actions. ZSL-2014-5169 additionally notes stored XSS and sessi...

CVE-2014-10006

Multiple cross-site request forgery CSRF vulnerabilities in Maian Uploader 4.0 allow remote attackers to hijack the authentication of unspecified users for requests that conduct cross-site scripting XSS attacks via the width parameter to 1 uploader/admin/js/loadflv.js.php or 2...

CVE-2014-100005

CVE-2014-100005 affects D-Link DIR-600 (revision Bx) routers with firmware before 2.17b02. The vulnerability comprises multiple CSRF flaws that can hijack administrator sessions and perform actions such as creating an admin account, enabling remote management via hedwig.cgi, applying new settings...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the administration console in TP-Link TL-WR840N V1 router with firmware before 3.13.27 build 141120 allows remote attackers to hijack the authentication of administrators for requests that change router settings via a configuration file import...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj40456...

CVE-2015-0920

Cross-site request forgery CSRF vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the bannereffectemail parameter in the BannerEffectOptions pag...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the bannereffectemail parameter in the BannerEffectOptions pag...

CVE-2014-4636

EMC Documentum Web Development Kit (WDK) prior to version 6.8 is affected by a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2014-4636). The issue allows an attacker to trick authenticated users into performing Docbase operations with their privileges by visiting a malicious link or page, ...