Cisco WebEx Training Center Cross-Site Request Forgery Vulnerabilities

A vulnerability in the web framework of Cisco WebEx Training Center could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by persuading a user to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in frontview/lib/nphandler.pl in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to hijack the authentication of users...

CVE-2013-5355

Multiple cross-site request forgery CSRF vulnerabilities in Sharetronix 3.1.1 allow remote attackers to hijack the authentication of administrators for requests that 1 change configuration settings or 2 create new administrative users via unspecified vectors...

RedHat Update for samba RHSA-2013:1542-02

Check for the Version of samba OpenVAS Vulnerability Test RedHat Update for samba RHSA-2013:1542-02 Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...

Cross site request forgery (csrf)

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding...

CVE-2013-3694

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding...

Tribq CMS 5.2.7 - Cross-Site Request Forgery (Adding/Editing New Administrator Account)

Exploit Title: Tribq CMS CSRF - Adding/Editing new administrator account Date: 2013 8 August Exploit Author: Yashar shahinzadeh Special thanks to Mormoroth Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir Vendor Homepage: http://sourceforge.net/projects/tribiq/ Tested on: Linux & Windows, PH...

Tribq CMS 5.2.7 Cross Site Request Forgery

Exploit Title: Tribq CMS CSRF - Adding/Editing new administrator account Date: 2013 8 August Exploit Author: Yashar shahinzadeh Special thanks to Mormoroth Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir Vendor Homepage: http://sourceforge.net/projects/tribiq/ Tested on: Linux & Windows, PH...

Cisco Unified Communications Manager Web Page Cross-Site Request Forgery Vulnerability

A vulnerability in the web pages of Cisco Unified Communications Manager Unified CM could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by...

Cisco Unified Communications Manager User Web Dialer Cross-Site Request Forgery Vulnerability

A vulnerability in the User WebDialer page of Cisco Unified Communications Manager Unified CM could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerabilit...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by convincing a...

Cisco Content Filtering Devices Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by convincing the...

Ecshop csrf可劫持用户账号

简要描述： 详细说明： 修改个人信息处未验证token，可通过一个精心构造的表单强制用户修改邮箱，达到劫持用户的目的，劫持用户账号只需要欺骗目标用户点击一个链接。 POC: None 劫持成功后，就可以去修改密码喽...

Foscam Cross Site Request Forgery

Embedded Web interface version 2.4.10.3 and older of Foscam FI8910W, FI8908W and many others is vulnerable to CSRF attacks. This allows attacker to perform calls to any CGI API using cached basic server authentication data stored in victims browser. Details: For example, the following URL request...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Enterprise 1.1.2 update

Red Hat OpenShift Enterprise 1.1.2, which fixes several security issues, is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for eac...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the portlet subsystem in the administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47 and 7.0 before 7.0.0.27 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site...

WordPress Plugin SolveMedia 1.1.0 - Cross-Site Request Forgery

Exploit Title: WordPress SolveMedia 1.1.0 CSRF Vulnerability Release Date: 24/01/13 Author: Junaid Hussain - illSecure Research Group - Contact: [email protected] | Website: http://illSecure.com Software Link: http://downloads.wordpress.org/plugin/solvemedia.1.1.0.zip Vendor Homepage:...

pfSense 2.0.1 - Cross-Site Scripting / Cross-Site Request Forgery / Remote Command Execution

Exploit Title: pfSense 2.0.1 XSS & CSRF Remote root Access Date: 04/01/2013 Author: Yann CAM @ Synetis Vendor or Software Link: www.pfsense.org Version: 2.0.1 Category: XSS & CSRF Remote root Access Google dork: Tested on: FreeBSD pfSense firewall/router distribution description :...

Multiple vulnerabilities in BabyGekko

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in BabyGekko, which can be exploited to include local PHP files, perform SQL Injection and Cross-Site Scripting XSS attacks. 1 Multiple SQL Injections in BabyGekko: CVE-2012-5698 Two SQL injections exist in BabyGekko...

SQL Injection Vulnerability in OrangeHRM

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in OrangeHRM, which could be exploited to alter SQL requests to application's database. 1 SQL Injection Vulnerability in Orange HRM: CVE-2012-5367 The vulnerability was discovered in the "/symfony/web/index.php" script...