ZEIT: Stored XSS on Zeit.co user profile

Hello team, There is a possibility to have a stored XSS in user profile. Steps to reproduce: 1. Go to zeit.co 2. Click on "Join for free" at the top right side of the page to go to https://zeit.co/signup 3. Select "Continue with GITLAB" note that you must have your Gitlab account logged in 4. Cli...

CVE-2019-0229

A number of HTTP endpoints in the Airflow webserver both RBAC and classic did not have adequate protection and were vulnerable to cross-site request forgery attacks...

openSUSE Security Update : Mozilla Thunderbird (openSUSE-2019-503)

This update for Mozilla Thunderbird to version 52.9.0 fixes multiple issues. Security issues fixed, inherited from the Mozilla common code base MFSA 2018-16, bsc1098998 : - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when using focus -...

openSUSE Security Update : MozillaThunderbird (openSUSE-2019-680)

This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are...

openSUSE Security Update : seamonkey (openSUSE-2019-602)

This update for seamonkey fixes the following issues : Mozilla SeaMonkey was updated to 2.49.4 : Now uses Gecko 52.9.1esr boo1098998. Security issues fixed with MFSA 2018-16 boo1098998 : - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when...

Cross site request forgery (csrf)

wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator password...

OOP CMS BLOG 1.0 Cross Site Request Forgery / SQL Injection Vulnerabilities

Exploit for php platform in category web applications Exploit Title: OOP CMS BLOG 1.0 - SQL Injection Exploit Author: Mr Winst0n Author E-mail: [email protected] Vendor Homepage: http://zsoft.com.bd/ Software Link :...

Cross site request forgery (csrf)

An issue was discovered in UsualToolCMS 8.0. cmsadmin/asqlbackx.php?t=sql allows CSRF attacks that can execute SQL statements, and consequently execute arbitrary PHP code by writing that code into a .php file...

CVE-2019-6244

Vulnerability summary (CVE-2019-6244): In UsualToolCMS 8.0, nonce CSRF protection flaw in the endpoint cmsadmin/a_sqlbackx.php?t=sql allows CSRF attacks that can trigger SQL statements and, consequently, write arbitrary PHP code to a .php file. This is documented across multiple sources (NVD entr...

CVE-2019-6244

An issue was discovered in UsualToolCMS 8.0. cmsadmin/asqlbackx.php?t=sql allows CSRF attacks that can execute SQL statements, and consequently execute arbitrary PHP code by writing that code into a .php file...

CVE-2018-20576

Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phonetest.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-specified telephone number. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan...

Cross-site Request Forgery (CSRF)

showdoc/showdoc is vulnerable to cross-site request forgery CSRF attacks. The vulnerability exists in /api/teamMember/save where it is possible to add members to a team through CSRF attacks...

OPENSUSE-SU-2018:3687-1 Security update for MozillaThunderbird

This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25 and MFSA 2018-28. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading...

CVE-2018-12414 TIBCO Rendezvous Vulnerable to CSRF Attacks

The Rendezvous Routing Daemon rvrd, Rendezvous Secure Routing Daemon rvrsd, Rendezvous Secure Daemon rvsd, Rendezvous Cache rvcache, and Rendezvous Daemon Manager rvdm components of TIBCO Software Inc.'s TIBCO Rendezvous, TIBCO Rendezvous Developer Edition, TIBCO Rendezvous for z/Linux, TIBCO...

CVE-2018-12413 TIBCO Messaging - Apache Kafka Distribution - Schema Repository Vulnerable to CSRF Attacks

The Schema repository server tibschemad component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition contains a vulnerability which may allow an...

CVE-2018-12411 TIBCO ActiveSpaces Administrative Daemon Vulnerable to CSRF Attacks

The administrative daemon tibdgadmind of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks...

CVE-2018-12415 TIBCO Enterprise Message Service Vulnerable to CSRF Attacks

The Central Administration server emsca component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contains a vulnerability which may allow an attacker to perform cross-site...

TIBCO Security Advisory: November 6, 2018 - TIBCO Enterprise MessageService

TIBCO Enterprise Message Service Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: January 28, 2020 CVE-2018-12415 Source: TIBCO Software Inc. TIBCO Enterprise Message Service Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: January 2...

TIBCO Security Advisory: November 6, 2018 - TIBCORendezvous

TIBCO Rendezvous Vulnerable to CSRF Attacks Original release date: November 6,2018 Last revised: CVE-2018-12414 Source: TIBCO Software Inc. TIBCO Rendezvous Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: Source: TIBCO Software Inc. Systems Affected TIBCO Rendezvo...

TIBCO Security Advisory: November 6, 2018 - TIBCO Messaging - Apache Kafka Distribution - SchemaRepository

TIBCO Messaging - Apache Kafka Distribution - Schema Repository Vulnerable to CSRF Attacks Original release date:November 6, 2018 Last revised: CVE-2018-12413 Source: TIBCO Software Inc. TIBCO Messaging - Apache Kafka Distribution - Schema Repository Vulnerable to CSRF Attacks Original release...