1850 matches found
osTicket 1.9.14 - 'X-Forwarded-For' Cross-Site Scripting
Exploit Title: Osticket 1.9.14 and below X-Forwarded-For Stored XSS. Date: 24-11-2016 Exploit Author: Joaquin Ramirez Martinez i0-SEC Software Link: http://osticket.com/ Vendor: Osticket """ ============== DESCRIPTION ============== osTicket is a widely-used open source support ticket system. It...
Horde Webmail < 5.2.16 Multiple Vulnerabilities
Horde Webmail is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:horde:hordegroupware"; if...
Magento Community Edition < 1.9.3 Multiple Vulnerabilities
Binary data 8963.prm...
CVE-2016-6444
A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against a Web Bridge user. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0...
CVE-2016-6444
A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against a Web Bridge user. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0...
Starbucks: CSRF: add item to victim's cart automatically (starbucks.com - updatecart)
Steps: 1. Victim login their starbucks account first. 2. Attacker send a form/link to victim. 3. If victim click the form/link, An item would automatically add to victim's cart. 4. If victim do not find this item, he/she would pay for this item which can greatly influence your repuation. Attached...
PHP Business Directory - Multiple Vulnerabilities
Exploit Title: PHP Business Directory - Multiple Vulnerabilities Date: 2016-10-16 Exploit Author: larrycompress Contact: [email protected] Type: webapps Platform: PHP Vendor Homepage: http://www.pagereactions.com/product.php?pku=4 Software Link:...
PHP NEWS 1.3.0 - Cross-Site Request Forgery (Add Admin)
========================================================================================================= Exploit Title: PHP NEWS 1.3.0 - Cross-Site Request Forgery Add Admin Author: Meryem AKDOĞAN Google Dork: - Date: 16/10/2016 Type: webapps Platform : PHP Vendor Homepage:...
PHP NEWS 1.3.0 - Cross-Site Request Forgery (Add Admin)
PHP NEWS 1.3.0 - Cross-Site Request Forgery Add Admin ========================================================================================================= Exploit Title: PHP NEWS 1.3.0 - Cross-Site Request Forgery Add Admin Author: Meryem AKDOĞAN Google Dork: - Date: 16/10/2016 Type: webapps...
Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for php platform in category web applications that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- input type="hidden...
Simple PHP Blog 0.8.4 Cross Site Request Forgery
that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- inp...
Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add Admin)
that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- input typ...
ASUS RT-N10 CSRF / Code Execution / XSS / Open Redirection
Hello list! There are multiple vulnerabilities in ASUS Wireless Router RT-N10. There are Code Execution, Cross-Site Scripting and URL Redirector Abuse vulnerabilities. ------------------------- Affected products: ------------------------- Vulnerable are the next models: ASUS RT-N10, RT-N10E,...
Khan Academy: Sensitive information/action is stored/done is done using a GET request
Description: The action to remove an email from account is done using a GET request and it has security token. The URL is : https://www.khanacademy.org/settings/unlinkaccount?email=134hackerone%40gmail.com&fkey= It is never a good practice to have sensitive information in URL. Following are the...
chatNow - Multiple Vulnerabilities
chatNow - Multiple Vulnerabilities Exploit Title: chatNow - Multiple Vulnerabilities Date: 2016-08-23 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: http://chatnow.thiagosf.net/ Software Link: https://github.com/thiagosf/chatNow/archive/master.zip Version: Latest comm...
chatNow - Multiple Vulnerabilities
Exploit for php platform in category web applications Exploit Title: chatNow - Multiple Vulnerabilities Date: 2016-08-23 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: http://chatnow.thiagosf.net/ Software Link: https://github.com/thiagosf/chatNow/archive/master.zip...
WSO2 Carbon 4.4.5 Cross Site Request Forgery / Denial Of Service
Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-CSRF-DOS.txt + ISR: ApparitionSec Vendor: ============ www.wso2.com Product: ================== Ws02Carbon v4.4.5 WSO2 Carbon is the core platform on which...
Open Upload 0.4.2 - Cross-Site Request Forgery (Add Admin)
================================================================================================================ Open Upload 0.4.2 Remote Admin Add CSRF Exploit and Changing Normal user permission...
Harvest: Opportunity to set arbitrary cookies
The location hash on a configure page is used to set a cookie value of the same content. Visiting of a page like https://%domain%.harvestapp.com/invoices/configurefoo will result into a foo cookie setting. This value isn't validated at all, which gives an attacker the opportunity to set arbitrary...
Open Upload 0.4.2 - Multiple Cross-Site Request Forgery Vulnerabilities
Exploit for php platform in category web applications ================================================================================================================ Open Upload 0.4.2 Remote Admin Add CSRF Exploit and Changing Normal user permission...