SASHA 0.2.0 Cross Site Scripting

Exploit Title: SASHA v0.2.0 Mutiple XSS Date: 12/16/11 Author: G13 Software Link: http://sourceforge.net/projects/sasha/files/ Version: 0.2.0 Category: webapps php Vulnerability When adding a new course to the schedule, the application relies on Client Side controls for input. This can easily be...

Simple Machines forum (SMF) 2.0 session hijacking

Exploit for php platform in category web applications Simple Machines forum SMF 2.0 session hijacking Found by The X-C3LL and seth http://0verl0ad.blogspot.com/ || http://xd-blog.com.ar/ 2011-08-06 Website: http://www.simplemachines.org/ Greets: yoyahack, eddyw, www.portalhacker.net SMF stops csr...

OpenX Ad Server CSRF Vulnerability

OpenX Ad Server is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

New DoS, CSRF and XSS vulnerabilities in ADSL modem Callisto 821+

Hello 3APA3A! I want to warn you about new security vulnerabilities in ADSL modem Callisto 821+ SI2000 Callisto821+ Router. These are Denial of Service, Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities. In April I've already drew attention of Ukrtelecom's representative and thi...

CVE-2011-1685

Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources aka external custom field option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery CSRF...

Cross site request forgery (csrf)

Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources aka external custom field option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery CSRF...

CVE-2011-1685

Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources aka external custom field option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery CSRF...

SAP NetWeaver SPML - XML CSRF user creation

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Command execution Exploits: YES Reported: 14.03.2011 Vendor response:16.03.2011 Date of Public Advisory:11.11.2011 CVSS: 7.3 Author: Alexandr Polyakov Description Attacker can create a new user in J2EE...

D-Link Routers - Authentication Bypass (1)

D-Link Routers - Authentication Bypass 1 Exploit Title: Multiple D-Link Router Authentication Bypass Vulnerabilities Date: 12-01-2011 Author: Craig Heffner, /dev/ttyS0 Firmware Link: http://www.dlink.co.uk/ Firmware Versions: All Tested on: DIR-300, DIR-320, DIR-615 revD Multiple D-Link routers...

CVE-2010-2892

gsb/drivers.php in LANDesk Management Gateway 4.0 through 4.0-1.48 and 4.2 through 4.2-1.8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the DRIVES parameter, as demonstrated by a cross-site request forgery CSRF attack...

Cross site request forgery (csrf)

gsb/drivers.php in LANDesk Management Gateway 4.0 through 4.0-1.48 and 4.2 through 4.2-1.8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the DRIVES parameter, as demonstrated by a cross-site request forgery CSRF attack...

CVE-2010-2892

gsb/drivers.php in LANDesk Management Gateway 4.0 through 4.0-1.48 and 4.2 through 4.2-1.8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the DRIVES parameter, as demonstrated by a cross-site request forgery CSRF attack...

CVE-2010-2892

The CVE-2010-2892 vulnerability affects LANDesk Management Gateway 4.0 (GSBWEB v1.61s) and 4.2 (GSBWEB v1.61), where the gsb/drivers.php component processes the DRIVES parameter without proper validation. This allows remote authenticated administrators to execute arbitrary commands via shell meta...

Jamb - Cross-Site Request Forgery (Add a Post)

!/usr/bin/python /\ \ /\ \ /'\ /\ \ \ \ /\ \ /\//\ \ /\ /\ \ \ \ \ \ \ \ \ /'\ /\ /\ \ \ \ /'\ \ \ \ \ /' \ /'\ /'\''\ /\ /\ \ \ \ \ \ / \ / | \ \\ /\ /\ \ \ \ \L\ /\ / /\ / \ /\ / \ / / \ \ / \ / \ \\ \\ / ,\ \ \ \ \ \ \x/' // //// ////// // /, ///...

WikiWebHelp v0. 3. 3 CSRF attack to modify the password vulnerability-vulnerability warning-the black bar safety net

WikiWebHelp v0. 3. 3 CMS the presence of CSRF（cross-site request forgery attack, the remote can modify the user password Exp: form name="CSRF" method="post" action=" http://127.0.0.1/wwh/handlers/updateprofile.php?id=1" input type='hidden' name='pass' value='password' input type='hidden'...

WikiWebHelp v0.3.3 Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications =========================================================== WikiWebHelp v0.3.3 Cross-Site Request Forgery Vulnerability =========================================================== Blog: yoyahack.blogspot.com Site: foro.undersecurity.net Mail:...

WikiWebHelp 0.3.3 - Cross-Site Request Forgery

WikiWebHelp 0.3.3 - Cross-Site Request Forgery Blog: yoyahack.blogspot.com Site: foro.undersecurity.net Mail: [email protected] CMS: WikiWebHelp The entire system is vulnerable to CSRF Cross-site request forgery since this does not include a system to prevent CSRF attacks ... Example...

Mod-X Cross Site Request Forgery / Cross Site Scripting

Got bored and decided to break the new website of the company I work for. Throughout I'll be dropping two new exploits that were chained to allow the changing of the administrative password of a default mod-x install. This is not a full review of mod-x, my main goal was just to break something, s...

CVE-2010-2234: Apache CouchDB Cross Site Request Forgery Attack

CVE-2010-2234: Apache CouchDB Cross Site Request Forgery Attack Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache CouchDB 0.8.0 to 0.11.0 Description: Apache CouchDB versions prior to version 0.11.1 are vulnerable to cross site request forgery CSRF attacks...

eXtreme Message Board 1.9.11 Cross Site Request Forgery

Date: Thu 15 Jul 2010 12:08:07 PM EEST Vendor: http://www.xmbforum.com/ Download: http://www.xmbforum.com/download/XMB-1.9.11.09.zip --- -= CSRF PoC 1 - Change Admin Password =- -= Method 1 - editprofile.php =- eXtreme Message Board 1.9.11 Multiple CSRF Vulnerabilities - Change Admin Password -=...