CVE-2017-5943

Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery CSRF verification tokens via a crafted URL...

WakaTime: Sensitive Cookie Without 'HttpOnly' Flag

hello wakatime security team i found security vulnerability:Sensitive Cookie Without 'HttpOnly' Flag when i was testing your website then i notice that there is some csrftoken cookie appare in responce but the cookie have not httponly flag.you must should set httponly flag for some following...

Discourse: Any user with invite capabilities can take-over any account on Discourse

Description Users with a trust level of 2 and above on Discourse being a member for 15 days,reading more than 100 posts and more - can be seen on: https://github.com/discourse/discourse/blob/b7386958edfb8215c99d90fde04521b3312d2ccd/config/sitesettings.yml can invite new users to join discourse by...

Cross-site Request Forgery (CSRF)

github.com/openshift/origin is vulnerable to cross-site request forgery CSRF attacks. These attacks are possible because it does not check the X-CSRF-Token header of requests...

Cross-site Request Forgery (CSRF)

github.com/astaxie/beego is vulnerable to cross-site request forgery CSRF attacks. The library does not implement a CSRF token to prevent such attacks...

Lessons Learned from SQL Injection Fix in Joomla 3.7.0

The Joomla community recently patched a SQL injection vulnerability introduced in Joomla 3.7.0. The article reporting this vulnerability explains how to identify the vulnerability which was discovered via static code analysis and how to craft an attack, e.g...

[20170702] - Core - XSS Vulnerability

Missing CSRF token checks and improper input validation lead to an XSS vulnerability...

Riverbed SteelHead VCX File Read

This module exploits an authenticated arbitrary file read in the log module's filter engine. SteelHead VCX VCX255U version 9.6.0a was confirmed as vulnerable. Module Options msf use auxiliary/scanner/http/riverbed/steelheadvcxfileread msf undefinedsteelheadvcxfileread show actions ...actions... m...

explo - Human And Machine Readable Web Vulnerability Testing Format

explo is a simple tool to describe web security issues in a human and machine readable format. By defining a request/condition workflow, explo is able to exploit security issues without the need of writing a script. This allows to share complex vulnerabilities in a simple readable and executable...

Weblate: Improper Cookie expiration | Cookies Expiration Set to Future

Hi Team, I have found at many instances or places from signup till getting logged into application in domain "demo.weblate.org" that session maintaining cookies such as csrf token and session id's expiration dates are set to future date. As part of secure session management one should prohibit or...

PlaySMS import.php Authenticated CSV File Upload Code Execution

This module exploits an authenticated file upload remote code excution vulnerability in PlaySMS Version 1.4. This issue is caused by improper file contents handling in import.php aka the Phonebook import feature. Authenticated Users can upload a CSV file containing a malicious payload via vectors...

PlaySMS sendfromfile.php Authenticated "Filename" Field Code Execution

This module exploits a code injection vulnerability within an authenticated file upload feature in PlaySMS v1.4. This issue is caused by improper file name handling in sendfromfile.php file. Authenticated Users can upload a file and rename the file with a malicious payload. This module was tested...

Cross-site Request Forgery (CSRF)

teampass is vulnerable to a cross-site request forgery CSRF attacks. The library does not use an anti-csrf token to prevent cross-site request forgery, allowing a malicious user to trick an authenticated user to execute malicious action on their behalf...

Weblate: Csrf in watch-unwatch projects

Hello, When you visit any projects from https://hosted.weblate.org/ , there is a button provided on top-right called Watch / Unwatch for each projects. when you click on that button, a POST request is sent which contains csrf token. But this request also works without that token. Just hit the url...

CVE-2016-3403

Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that 1 add, 2 modify, or 3 remove accounts by leveraging failure to use of a CSRF token and...

CVE-2016-3403

Zimbra Collaboration Server (Admin Console) vulnerable to multiple CSRF flaws in versions before 8.6.0 Patch 8. CSRF tokens and referer header checks are not enforced, enabling remote attackers to hijack administrator sessions and perform add/modify/remove account actions (bugs 100885/100899). Re...

CVE-2016-3403

Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that 1 add, 2 modify, or 3 remove accounts by leveraging failure to use of a CSRF token and...

Starbucks: Missing CSRF Token On Remove Coupun From Cart

Hi, When remove coupun, there's no CSRF token, at this time i use ███████ Coupun to reproduce it. Vuln Request POST /on/demandware.store/Sites-Teavana-Site/default/Cart-RemoveCoupon HTTP/1.1 Host: www.teavana.com User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64; rv:53.0 Gecko/20100101 Firefox/53.0...

Starbucks: Missing CSRF Token On Add Coupon To Basket

Hi, When Adding Coupun It's missing CSRF Token, and at this time, i use BOGO50 Coupun to reproduce it. Vuln Request POST /on/demandware.store/Sites-Teavana-Site/default/Home-AddCouponToBasket?couponcode=BOGO50&format=ajax HTTP/1.1 Host: www.teavana.com User-Agent: Mozilla/5.0 Windows NT 6.1; WOW6...

EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2016-1054)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote...