Vimeo: CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go public

Hello Vimeo Security Team. There is a CSRF vulnerability on Vimeo.com. With this vulnerability, an attacker can make all the victim's vimeo videos go public just by having the victim open a link to the attacker webpage. He can also get the victim's vimeo name, user id, user account type and perfo...

UBUNTU-CVE-2016-1949

Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a request for a...

ok.ru: Same-Origin Policy bypass on main domain - ok.ru

Hello, I've just found a way to bypass Same-Origin Policy mechanism using vulnerability in one of swf files on your cdn. Let me explain this in details: 1. First of all - your Crossdomain which defines from what domains Flash files can read content on ok.ru. Crossdomain file is located here -...

Mobile Vikings: Insecure crossdomain.xml

Hi, https://mobilevikings.be/crossdomain.xml contains the following xml file: This will make any one able to receive content from https://mobilevikings.be/. More information about this issue is available here: http://gursevkalra.blogspot.nl/2013/08/bypassing-same-origin-policy-with-flash.html Bes...

123 flashchat 7.8 - Multiple Vulnerabilities

No description provided by source. |------------------------------------------------------------------| | | | / / / / | | / / / / / / / \ / / / / \ | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// // // | | | | http://www.corelan.be:8800 | |...

Ucenter Projekt 2.0 Insecure crossdomain (XSS) Vulnerability

No description provided by source...

phpwind配置不当可导致CSRF发帖

简要描述： phpwind配置不当可导致CSRF发帖 详细说明： crossdomain.xml的默认设置： - 虽然有建议 但是普通站长谁没事改这个啊，还不如你们在安装时直接根据host重写下crossdomain.xml得了。 先取到csrf的token function gethash function getformhashtxt txt = txt.split'csrftoken" value="'1.split'"'0; return txt; var resultlv:LoadVars = new LoadVars; resultlv.onData = functiontx...

Geonick Social Network Clickjacking / Credential Disclosure

GEONICK SOCIAL-NETWORK Insecure crossdomain.xml file / Clickjacking: X-Frame-Options header missing / User credentials are sent in clear text Time-Line Vulnerability Multiple Advisories but NOT RESPONSE Then Full Disclosure I-VULNERABILITY ------------------------- Title: GEONICK SOCIAL-NETWORK...

cURL / libcurl information leak

Crossdomain cooke access...

IcedTea-Web security vulnerabilities

Crossdomain access, code execution...

flash crossdomain.xml 跨站请求伪造

No description provided by source...

SAP Xcelsius - insecure crossdomain policy

Application: SAP Portal Xcelsius dashboards Vendor URL: http://www.sap.com Bugs: insecure crossdomain policy Exploits: YES Reported: 12.03.2012 Vendor response: 12.03.2012 Date of SAP Security Note Published: 08.01.2013 Date of Public Advisory: 29.01.2013 Reference: SAP Security Note 1412864...

123 Flashchat Directory Traversal / Cross Site Scripting

|------------------------------------------------------------------| | | | / / / / | | / / / / / / / \ / / / / \ | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// // // | | | | http://www.corelan.be:8800 | | [email protected] | | |...

123 FlashChat 7.8 - Multiple Vulnerabilities

|------------------------------------------------------------------| | | | / / / / | | / / / / / / / \ / / / / \ | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// // // | | | | http://www.corelan.be:8800 | | [email protected] | | |...

123 Flashchat version 7.8 Multiple Remote Vulnerabilities

Exploit for windows platform in category remote exploits ========================================================= 123 Flashchat version 7.8 Multiple Remote Vulnerabilities ========================================================= |-----------------------------------------------------------------...

123 FlashChat 7.8 - Multiple Vulnerabilities

123 FlashChat 7.8 - Multiple Vulnerabilities |------------------------------------------------------------------| | | | / / / / | | / / / / / / / \ / / / / \ | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// // // | | | | http://www.corelan.be:8800 | |...

123 Flashchat version 7.8 Multiple Remote Vulnerabilities

Exploit for windows platform in category remote exploits ========================================================= 123 Flashchat version 7.8 Multiple Remote Vulnerabilities ========================================================= |-----------------------------------------------------------------...

Apple Webkit / Safari multiple security vulnerabilities

Information leak, crossdomain access, buffer overflows, memory corruptions...

Ucenter Projekt 2.0 - Insecure crossdomain (Cross-Site Scripting)

======================================================================================== | Title : Ucenter Projekt 2.0 Insecure crossdomain XSS Vulnerability | Author : indoushka | email : [email protected] | Home : www.iqs3cur1ty.com | Web Site : | Dork : Powered by UCenter 1.5.0 © 2001 - 20...

Ucenter Projekt 2.0 Insecure crossdomain (XSS) Vulnerability

Exploit for php platform in category web applications ============================================================ Ucenter Projekt 2.0 Insecure crossdomain XSS Vulnerability ============================================================...