1356 matches found
Lessons Learned from SQL Injection Fix in Joomla 3.7.0
The Joomla community recently patched a SQL injection vulnerability introduced in Joomla 3.7.0. The article reporting this vulnerability explains how to identify the vulnerability which was discovered via static code analysis and how to craft an attack, e.g...
[20170702] - Core - XSS Vulnerability
Missing CSRF token checks and improper input validation lead to an XSS vulnerability...
Riverbed SteelHead VCX File Read
This module exploits an authenticated arbitrary file read in the log module's filter engine. SteelHead VCX VCX255U version 9.6.0a was confirmed as vulnerable. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...
explo - Human And Machine Readable Web Vulnerability Testing Format
explo is a simple tool to describe web security issues in a human and machine readable format. By defining a request/condition workflow, explo is able to exploit security issues without the need of writing a script. This allows to share complex vulnerabilities in a simple readable and executable...
Weblate: Improper Cookie expiration | Cookies Expiration Set to Future
Hi Team, I have found at many instances or places from signup till getting logged into application in domain "demo.weblate.org" that session maintaining cookies such as csrf token and session id's expiration dates are set to future date. As part of secure session management one should prohibit or...
Cross-site Request Forgery (CSRF)
teampass is vulnerable to a cross-site request forgery CSRF attacks. The library does not use an anti-csrf token to prevent cross-site request forgery, allowing a malicious user to trick an authenticated user to execute malicious action on their behalf...
Weblate: Csrf in watch-unwatch projects
Hello, When you visit any projects from https://hosted.weblate.org/ , there is a button provided on top-right called Watch / Unwatch for each projects. when you click on that button, a POST request is sent which contains csrf token. But this request also works without that token. Just hit the url...
CVE-2016-3403
Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that 1 add, 2 modify, or 3 remove accounts by leveraging failure to use of a CSRF token and...
CVE-2016-3403
Zimbra Collaboration Server (Admin Console) vulnerable to multiple CSRF flaws in versions before 8.6.0 Patch 8. CSRF tokens and referer header checks are not enforced, enabling remote attackers to hijack administrator sessions and perform add/modify/remove account actions (bugs 100885/100899). Re...
CVE-2016-3403
Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that 1 add, 2 modify, or 3 remove accounts by leveraging failure to use of a CSRF token and...
Starbucks: Missing CSRF Token On Remove Coupun From Cart
Hi, When remove coupun, there's no CSRF token, at this time i use ███████ Coupun to reproduce it. Vuln Request POST /on/demandware.store/Sites-Teavana-Site/default/Cart-RemoveCoupon HTTP/1.1 Host: www.teavana.com User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64; rv:53.0 Gecko/20100101 Firefox/53.0...
Starbucks: Missing CSRF Token On Add Coupon To Basket
Hi, When Adding Coupun It's missing CSRF Token, and at this time, i use BOGO50 Coupun to reproduce it. Vuln Request POST /on/demandware.store/Sites-Teavana-Site/default/Home-AddCouponToBasket?couponcode=BOGO50&format=ajax HTTP/1.1 Host: www.teavana.com User-Agent: Mozilla/5.0 Windows NT 6.1; WOW6...
EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2016-1054)
According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote...
Revive Ad Server 4.0.1 - Cross-Site Scripting Cross-Site Request Forgery
Revive Ad Server 4.0.1 - Cross-Site Scripting Cross-Site Request Forgery --------------------------------------------------------------- Exploit Title: XSRF Stored Revive Ad Server 4.0.1 Date: 24/04/2017 Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT Vendor Website :...
Revive Ad Server 4.0.1 - Cross-Site Scripting / Cross-Site Request Forgery
--------------------------------------------------------------- Exploit Title: XSRF Stored Revive Ad Server 4.0.1 Date: 24/04/2017 Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT Vendor Website : https://www.revive-adserver.com/ Software download : https://www.revive-adserver.com/download/...
FlySpray 1.0-rc4 - Cross-Site Scripting / Cross-Site Request Forgery
Exploit Title: XSRF Stored FlySpray 1.0-rc4 XSS2CSRF add admin account Date: 19/04/2017 Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT : https://www.openoffice.org Version: 1.0-rc4 Tested on: Windows 7 x64 SP1 / Kali Linux Description : A vulnerability has been discovered in Flyspray , which ca...
FlySpray 1.0-rc4 - Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities
Exploit for php platform in category web applications Exploit Title: XSRF Stored FlySpray 1.0-rc4 XSS2CSRF add admin account Date: 19/04/2017 Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT : https://www.openoffice.org Version: 1.0-rc4 Tested on: Windows 7 x64 SP1 / Kali Linux Description : A...
Weblate: CSRF : Lock and Unlock Translation
Description : Attacker can force to victim for Lock and Unlock Translation. That HTTP Request : GET /lock/aptoide-uploader/strings/ka/ HTTP/1.1 Host: hosted.weblate.org Connection: close Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10123 AppleWebKit/537.36 KHTML,...
Weblate: Logout CSRF
Hi Team, This is a low risk but want you to know that logout on this domain demo.weblate.org did not protect the logout form with csrf token, therefor i can logout any user by sending this url https://demo.webplate.org/accounts/logout/. Logout should have post method with a valid csrf token. Let ...
