Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Limny 2.0 allow remote attackers to 1 hijack the authentication of users or administrators for requests that change the email address or password via the user action to index.php, and 2 hijack the authentication of the administrator for...

CVE-2009-4605

scripts/setup.php aka the setup script in phpMyAdmin 2.11.x before 2.11.10 calls the unserialize function on the values of the 1 configuration and 2 v0 parameters, which might allow remote attackers to conduct cross-site request forgery CSRF attacks via unspecified vectors...

Ubuntu: Security Advisory (USN-885-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SEC Consult SA-20100115-0 :: Local file inclusion/execution and multiple CSRF vulnerabilities in LetoDMS (formerly MyDMS)

SEC Consult Security Advisory 20100115-0 ======================================================================== title: Local file inclusion/execution and multiple Cross-Site-Request-Forgery vulnerabilities in LetoDMS formerly MyDMS products: LetoDMS formerly MyDMS vulnerable version: LetoDMS...

LetoDMS Local File Inclusion / Cross Site Request Forgery

SEC Consult Security Advisory ======================================================================== title: Local file inclusion/execution and multiple Cross-Site-Request-Forgery vulnerabilities in LetoDMS formerly MyDMS products: LetoDMS formerly MyDMS vulnerable version: LetoDMS formerly MyDM...

RedHat Security Advisory RHSA-2009:1490

The remote host is missing updates announced in advisory RHSA-2009:1490. SquirrelMail is a standards-based webmail package written in PHP. Form submissions in SquirrelMail did not implement protection against Cross-Site Request Forgery CSRF attacks. If a remote attacker tricked a user into visiti...

Cross site request forgery (csrf)

PHPKIT 1.6.4 PL1 includes the session ID in the URL, which allows remote attackers to conduct cross-site request forgery CSRF attacks by reading the PHPKITSID parameter from the HTTP Referer and using it in a request to 1 modify the user profile via uploadfiles/include.php or 2 create a new...

DEFCON: CSRF Attacks Made Easy

LAS VEGAS — The security of social networking sites isn’t as bad as you think. In fact, it’s much worse. Sites such as Twitter, Facebook and others that rely heavily on user-generated content, shared content and aggregation have been the targets of increasingly sophisticated attacks over the last...

Virtualmin Symlink / XSS / More

Virtualmin Multiple Vulnerabilities by Filip Palian alertdocument.cookie; https://127.0.0.1:10000/virtual-server/link.cgi/%3Ci%3E%3Cscript%3Ealertdocument.cookie;%3C/script%3E 3 Anonymous proxy The attacker is able to use "Preview Website" featrue to hide hers real location and conduct attacks on...

Virtualmin < 3.703 Multiple Local/Remote Vulnerabilities

Exploit for linux platform in category remote exploits ======================================================== Virtualmin alertdocument.cookie; https://127.0.0.1:10000/virtual-server/link.cgi/%3Ci%3E%3Cscript%3Ealertdocument.cookie;%3C/script%3E 3 Anonymous proxy The attacker is able to use...

CVE-2009-1576

Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows user-assisted remote attackers to obtain sensitive information by tricking victims into visiting the front page of the site with a crafted URL and causing form data to be sent to an...

Mandriva Linux Security Advisory : cups (MDVSA-2009:028)

Security vulnerabilities have been discovered and corrected in CUPS. CUPS before 1.3.8 allows local users, and possibly remote attackers, to cause a denial of service daemon crash by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference CVE-2008-5183. The web...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in index.tmpl in Vuze formerly Azureus HTML WebUI, probably 0.7.6, allows remote attackers to hijack the authentication of users for requests that force the download of arbitrary torrent files via the upurl parameter...

IE8 and click on the kidnapping and CSRF of battle-vulnerabilities-warning-the black bar safety net

In recent years, the Web security threats increasingly serious, cross-site scripting attacks, cross-site request forgery attacks, Clickjacking attacks, etc., abound. We know, web security and browser are closely related, because the browser is web application execution environment, just like a...

FreeBSD Ports: cups-base

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2008-5184

The web interface cgi-bin/admin.c in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the 1 add and 2 cancel RSS subscription functions...

CVE-2008-5184

The web interface cgi-bin/admin.c in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the 1 add and 2 cancel RSS subscription functions...

CVE-2008-5113

CVE-2008-5113 affects WordPress 2.6.3, where reliance on the REQUEST superglobal in certain dangerous situations enables remote attackers to perform delayed, persistent CSRF via crafted cookies, potentially deleting user accounts or causing denial of service. The description notes an independent ...

[Backports-security-announce] Security Update for proftpd-dfsg

Francesco Paolo Lovergine uploaded new packages for proftpd-dfsg which fixed the following security problem: CVE-2008-4242, Debian Bug 502674 ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery CSRF...

CVE-2008-4247

ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery CSRF attacks and execute arbitrary FTP commands via a long ftp:// URI...