Websense Triton Content Manager 8.0.0 Build 1165 Buffer Overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Stack buffer overflow in handledebugnetwork product: Websense Triton Content Manager vulnerable version: 8.0.0 build 1165...

WordPress Google Plus One Button By KMS 1.5.0 CSRF / XSS

Title: WordPress 'Google 'Plus one' Button by kms' Plugin Version: 1.5.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: - https://wordpress.org/plugins/google-plus-one-button-by-kms/ - https://plugins.svn.wordpress.org/google-plus-one-button-by-kms/ Notified...

PT-2015-6493 · Cisco · Cisco Unified Intelligence Center

Name of the Vulnerable Software and Affected Versions: Cisco Unified Intelligence Center versions 10.01 through 10.61 Description: A cross-site request forgery CSRF issue in the web framework allows remote attackers to hijack the authentication of arbitrary users. Recommendations: For versions...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit th...

ManageEngine EventLog Analyzer Cross Site Request Forgery

A cross site request forgery vulnerability exists in ManageEngine EventLog Analyzer. The vulnerability is due to insufficient input validation of parameters sent to event/userManagementForm.do. By convincing a user to follow a malicious link, a remote attacker can exploit this vulnerability to...

Resource Data Management Privilege Escalation Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified two vulnerabilities in Resource Data Management’s Data Manager application. Resource Data Management has produced a new version to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS Resourc...

CVE-2015-3191 - CSRF attack on change email | Cloud Foundry

CVE-2015-3191 – CSRF attack on change email Low Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v210 UAA versions prior to 2.3.0 Description The changeemail form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user...

ClickHeat 1.14 - Cross-Site Request Forgery (Change Admin Password)

ClickHeat 1.14 - Cross-Site Request Forgery Change Admin Password Exploit Title: ClickHeat input type="hidden" name="config" value="a:23:s:7:"logPath";s:31:"C:/xampp /htdocs/clickheat/logs/";s:9:"cachePath";s:32:"C:/xampp/htdocs/clickheat...

Legal Robot: CSRF

Security researcher identified a logout CSRF attack, which was later patched...

Comodo GeekBuddy Local Privilege Escalation

Comodo GeekBuddy Local Privilege Escalation CVE-2014-7872 Jeremy Brown jbrown3264/gmail -Synopsis- Comodo GeekBuddy, which is bundled with Comodo Anti-Virus, Comodo Firewall and Comodo Internet Security, runs a passwordless, background VNC server and listens for incoming connections. This can all...

Embed Articles <= 7.0.3 - CSRF & Stored XSS

This plugin has since been discontinued...

thunderbird security update

CentOS Errata and Security Advisory CESA-2015:0771 An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/...

Ubiquiti Inc.: CSRF in login form would led to account takeover

This researcher was able to demonstrate an CSRF attack against a now decommissioned we service...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Contact Form DB aka CFDB and contact-form-7-to-database-extension plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the...

EVO-CMS 2.1.0 Cross Site Request Forgery

Affected software: evo cms Type of vulnerability: adding new admin csrf URL: http://www.evo-german.com/ Discovered by: Provensec Website: http://www.provensec.com version:EVO-CMS 2.1.0 Proof of concept attacker was able to add new admin as there were no protection against csrf poc poc: input...

WordPress Image Metadata Cruncher CSRF / XSS Vulnerabilities

WordPress Image Metadata Cruncher plugin suffers from cross site request forgery and stored cross site scripting vulnerabilities. Title: CSRF / Stored XSS Vulnerability in IMAGE-MEtadata-Cruncher Wordpress Plugin Author: Kaustubh G. Padwad CVE-ID : CVE-2015-1614 Plugin Homepage:...

Fat Free CRM Gem being vulnerable to CSRF-type attacks

Fat Free CRM contains a flaw as HTTP requests to /admin/users do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Reques...

CVE-2015-1432

The messageoptions function in includes/ucp/ucppmoptions.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors...

Enter: CSRF token leakage

Hi, I have noticed that when the account verification fails here : https://wallet.robocoin.com/verify/ due to an error, the CSRF token is being leaked via GET method like : https://wallet.robocoin.com/verify/id?csrf=b8ede20d-0c0b-4e16-9d05-6ad2ed8b72c4 So the authenticity token is being stored in...