CVE-2017-7990

The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp...

Faveo Helpdesk Community 1.9.3 - Cross-Site Request Forgery

Exploit Title: CSRF / Privilege Escalation Manipulation of Role Agent to Admin on Faveo version Community 1.9.3 Google Dork: no Date: 05-April-2017 Exploit Author: @runggareksya, @yokoacc, @AdyWikradinata, @dickysofficial, @dvnrcy Vendor Homepage: http://www.faveohelpdesk.com/ Software Link:...

CVE-2016-10313

Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to conduct CSRF attacks via certain /goform/ pages...

CVE-2014-9136

Huawei FusionManager with software V100R002C03 and V100R003C00 could allow an unauthenticated, remote attacker to conduct a CSRF attack against the user of the web interface...

CVE-2014-9136

CVE-2014-9136 concerns a CSRF vulnerability in Huawei FusionManager web interface. Affected products are FusionManager versions V100R002C03 and V100R003C00 . The issue allows an unauthenticated, remote attacker to perform a CSRF attack against a user of the web interface. The linked Huawei securi...

CVE-2014-9137

CVE-2014-9137 is a CSRF vulnerability in Huawei USG firewall web interfaces affecting USG9500 (V200R001C01SPC800 and earlier; V300R001C00), USG2100 (V300R001C00SPC900 and earlier), USG2200 (V300R001C00SPC900), and USG5100 (V300R001C00SPC900). An unauthenticated remote attacker could conduct a CSR...

Radancy: Possible to unsubscribe from activities using CSRF @ mijn.werkenbijdefensie.nl

Domain and URL: https://mijn.werkenbijdefensie.nl/activiteiten/bezocht Summary: Possible to unsubscribe from activities/events using CSRF Description: it is possible to unsubscribe a logged in user from any subscribed events. The unsubscribe is done by a GET-call which is of course not protected ...

Urban Dictionary: Session replay vulnerability in www.urbandictionary.com

Session replay vulnerability in www.urbandictionary.com I considered titling this bug "Session tokens not expiring", which is what you need to tell your development team. But I titled it as I did to emphasize at least one attack made possible by the bug. There may be others. Description Privilege...

LocalTapiola: Brute force unsubscription on /webApp/unsub_sb (viestinta.lahitapiola.fi)

Basic report information Summary: CSRF is an attack that tricks the victim into submitting a malicious request. It inherits the identity and privileges of the victim to perform an undesired function on the victim's behalf Description: Any user subscribed to Active Campaign, or admin too, attacker...

CVE-2016-9365

An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPor...

Zoneminder 1.29 / 1.30 CSRF / XSS / SQL Injection / Session Fixation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 === FOXMOLE - Security Advisory 2016-07-05 === Zoneminder multiple vulnerabilities Affected Versions ================= Zoneminder 1.29,1.30 Issue Overview ============== Vulnerability Type: SQL Injection, Cross Site Scripting, Session Fixation, No...

CVE-2016-6468

A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. More Information: CSCvb06663. Known Affected Releases:...

Topsy CSRF of burrows instance share-vulnerability warning-the black bar safety net

0x01 Foreword Recent digging in the SRC often encounter some CSRF vulnerabilities and found that in fact grasp the principle after it is easy to dig to about the CSRF vulnerability. In the usual vulnerability discovery, CSRF is also not too high threshold, the technical requirements are not so...

WordPress Image Gallery 1.9.65 Cross Site Scripting Vulnerability

WordPress Image Gallery plugin version 1.9.65 suffers from a persistent cross site scripting vulnerability. ------------------------------------------------------------------------ Stored Cross-Site Scripting in Gallery - Image Gallery WordPress Plugin...

osTicket 1.9.14 - 'X-Forwarded-For' Cross-Site Scripting

Exploit Title: Osticket 1.9.14 and below X-Forwarded-For Stored XSS. Date: 24-11-2016 Exploit Author: Joaquin Ramirez Martinez i0-SEC Software Link: http://osticket.com/ Vendor: Osticket """ ============== DESCRIPTION ============== osTicket is a widely-used open source support ticket system. It...

Horde Webmail < 5.2.16 Multiple Vulnerabilities

Horde Webmail is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:horde:hordegroupware"; if...

Magento Community Edition < 1.9.3 Multiple Vulnerabilities

Binary data 8963.prm...

CVE-2016-6444

A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against a Web Bridge user. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0...

CVE-2016-6444

A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against a Web Bridge user. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0...

Starbucks: CSRF: add item to victim's cart automatically (starbucks.com - updatecart)

Steps: 1. Victim login their starbucks account first. 2. Attacker send a form/link to victim. 3. If victim click the form/link, An item would automatically add to victim's cart. 4. If victim do not find this item, he/she would pay for this item which can greatly influence your repuation. Attached...