Cross site request forgery (csrf)

The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy CSP protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication toke...

Yona CMS 1.3.x Cross Site Request Forgery

Exploit Title: Yona CMS document.forms0.submit;...

Yona CMS - Cross-Site Request Forgery

Yona CMS - Cross-Site Request Forgery document.forms0.submit;...

Airia - Cross-Site Request Forgery (Add Content)

document.forms.csrfpoc.submit;...

Nextcloud: Lost Password CSRF

Hi, I think it is something about your Wordpress version.It's not something highy risky bu it is vulnerability. CODE: Username or Email For testing CSRF I added the .html file to attachments.And there is a screenshot for you. How To Fix : Adding rpkey will be fine. Please take a look at links bel...

Ultrabenosaurus ChatBoard - Cross-Site Request Forgery (Send Message)

form name="csrfpoc" action="http://127.0.0.1/vulte...

CVE-2015-5170-5173 UAA Vulnerabilities | Cloud Foundry

CVE-2015-5170-5173 UAA Vulnerabilities Low Vendor Cloud Foundry Foundation Versions Affected cf-release versions v215 & prior UAA versions 2.5.1 & prior Description CSRF Attack on PWS. It is possible to log the user into another account instead of the account they intended to log into because of...

EMC ViPR SRM - Cross-Site Request Forgery

Exploit for php platform in category web applications !-- EMC M&R Watch4net lacks Cross-Site Request Forgery protection Abstract It was discovered that EMC M&R Watch4net does not protect against Cross-Site Request Forgery CSRF attacks. A successful CSRF attack can compromise end user data and may...

EMC ViPR SRM - Cross-Site Request Forgery

!-- EMC M&R Watch4net lacks Cross-Site Request Forgery protection Abstract It was discovered that EMC M&R Watch4net does not protect against Cross-Site Request Forgery CSRF attacks. A successful CSRF attack can compromise end user data and may allow an attacker to perform an account hijack. If th...

Multiple Vulnerabilities in phpMyBackupPro

phpMyBackupPro is a professional MySql backup tool. A remote command execution and cross-site request forgery vulnerability exists in phpMyBackupPro 2.5. phpMyBackupPro uses a php configuration file globalconf.php to manage the settings, allowing the user to change the sql host, emails, etc. The...

No Password Required! 135 Million Modems Open to Remote Factory Reset

More than 135 Million modems around the world are vulnerable to a flaw that can be exploited remotely to knock them offline by cutting off the Internet access. The simple and easily exploitable vulnerability has been uncovered in one of the most popular and widely-used cable modem, the Arris...

LocalTapiola: The PdfServlet-functionality used by the "Tee vakuutustodistus" allows injection of custom PDF-content via CSRF-attack

Issue The reporter found an issue when the user creates a "Vakuutustodistus". The last page of the functionality shows a button "Lataa vakuutustodistus omalle koneellesi tulostusta varten." and contains a hidden form input-field "encodedPdfContent". By changing the "encodedPdfContent"-content, a...

Bumble: [CRITICAL] Full account takeover using CSRF

Hi , I have found a CSRF issue that allows an attacker to link his gmail , facebook ... or any social account to the victim's account and hijack the whole account. Details: When a user tries to link a gmail account with his account , after he authorizes badoo to use his gmail account he will be...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on ReadyNet WRT300N-DD devices with firmware 1.0.26 allows remote attackers to hijack the authentication of arbitrary users...

X (Formerly Twitter): URGENT : NICHE.co Account Take Over Vulnerability

Hello ! This is an urgent report that you should immediately take care of !! I found out an account take over vulnerability on your acquisition : niche.co Proof of concept code CSRF Attack Page: /get-started/complete s The authenticitytoken parameter is not properly validated by the end of the...

HooToo Tripmate HT-TM01 Cross Site Request Forgery

Exploit Title: HooToo Tripmate HT-TM01 Cross Site Request Forgery Date: 03Sep15 Exploit Author: Ken Smith Contact: https://twitter.com/P4tchw0rk Vendor Homepage: http://www.hootoo.com Version: HT-TM01, version 2.000.022 1. Description Various functions in the device's admin web portal are...

WordPress Private Only 3.5.1 CSRF / Cross Site Scripting Vulnerabilities

Exploit for php platform in category web applications Details ================ Software: Private Only Version: 3.5.1 Homepage: http://wordpress.org/plugins/private-only/ Advisory report:...

WordPress SQL injection vulnerability and provide the right analysis-vulnerability warning-the black bar safety net

2313258f75eee9e3bf398ed6d1f0bb17 Reading: 2 7 5 WordPress core functionalitySQL injectionvulnerability analysis Threat Response Fellow at the center for the Wordpress core functionalitySQL injectionvulnerabilities number of CVE-2 0 1 5-5 6 2 3 and CVE-2 0 1 5-2 2 1 3for a detailed analysis 0x00...

Cisco Prime Infrastructure Web Interface Cross-Site Request Forgery Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this...

SEC Consult SA-20150805-0 :: Websense Content Gateway Stack Buffer Overflow in handle_debug_network

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20150805-0 ======================================================================= title: Stack buffer overflow in handledebugnetwork product: Websense Triton Content Manager vulnerable version: 8.0.0...