CVE-2010-1547

CVE-2010-1547 concerns CSRF vulnerabilities in the Drupal Chaos Tool Suite (CTools) module, version 6.x prior to 6.x-1.4. The issue allows remote attackers to hijack administrator sessions by issuing requests that enable or disable a page via specific q parameters (q=admin/build/pages/nojs/enable...

CVE-2010-2007

CVE-2010-2007 describes multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) 1.7.2 and earlier. The issues allow remote attackers to hijack administrator authentication for requests to specific endpoints: op/op.EditUserData.php, op/op.UsrMgr.php, out/out.RemoveVe...

CVE-2009-4849

ToutVirtual VirtualIQ Pro is affected by multiple CSRF vulnerabilities in versions 3.2 (build 7882) and 3.5 (build 8691). The flaws allow remote attackers to hijack administrator sessions and perform sensitive actions via requests to tvserver/user/user.do, including creating a new user account, s...

CVE-2010-1732

Cross-site request forgery CSRF vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to hijack the authentication of administrators for requests that change the administrator email address updateemail action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to hijack the authentication of administrators for requests that change the administrator email address updateemail action...

CVE-2010-1610

Cross-site request forgery CSRF vulnerability in index.php in OpenCart 1.4 allows remote attackers to hijack the authentication of an application administrator for requests that create an administrative account via a POST request with the route parameter set to "user/user/insert." NOTE: some of...

CVE-2010-1611

CVE-2010-1611 : In AlegroCart 1.1, a cross-site request forgery (CSRF) vulnerability could allow remote attackers to hijack the administrator’s session and reset the administrator password via a POST to the admin/ endpoint with an update action. The provided documents confirm the affected product...

CVE-2010-1037

Cross-site request forgery CSRF vulnerability in HP System Insight Manager before 6.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in HP System Insight Manager before 6.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2010-1037

Cross-site request forgery CSRF vulnerability in HP System Insight Manager before 6.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admin.php in Mail Manager Pro allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a change action...

CVE-2009-4827

The CVE-2009-4827 issue affects Mail Manager Pro, specifically the admin.php component. A cross-site request forgery (CSRF) vulnerability exists that allows remote attackers to hijack administrator sessions and perform password-change actions via a crafted request. The underlying impact is that a...

CVE-2009-4826

CSRF vulnerability CVE-2009-4826 affects ScriptsEz Mini Hosting Panel, specifically hosting/admin_ac.php. The issue allows an attacker to hijack administrator authentication and perform requests that alter admin settings via a cp action. Impact described as unauthorized admin actions with potenti...

CVE-2010-1542

Multiple cross-site request forgery CSRF vulnerabilities in admin/configure.php in DFD Cart 1.198, 1.197, and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 conduct cross-site scripting XSS attacks or 2 change unspecified settings...

CVE-2009-4773

Cross-site request forgery CSRF vulnerability in the order-management functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Pulse CMS view.php页面跨站请求伪造漏洞

BUGTRAQ ID: 38356 CVE ID: CVE-2010-0992 Pulse是一个Web应用程序开发框架和门户网站搭建解决方案。 Pulse CMS没有执行充分的有效性检查便允许用户通过HTTP请求执行某些操作，如果已登录用户访问了恶意网站就会允许远程攻击者劫持用户的认证，代表该用户执行上传图形或删除文件或创建块等请求。 Pulse CMS Pulse CMS Basic 1.2.3 Pulse CMS Pulse CMS Basic 1.2.2 厂商补丁： Pulse CMS --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2010-1244

Cross-site request forgery CSRF vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action...

CVE-2010-0921

Cross-site request forgery CSRF vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 allows remote attackers to hijack the authentication of unspecified victims via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack the authentication of an administrator for 1 requests that reset user passwords via zport/dmd/ZenUsers/admin, and 2 requests that change user commands, which...

CVE-2010-0713

Zenoss Server (Zenoss 2.3.3 and earlier