Cuvva: CSRF on cuvva.insure allows to attacker to send multiple SMS to download the app without visiting the cuvva

Description : cuvva.co allows user to send app download link to his/her mobile number via SMS. But attacker can abuse this system via cross site request forgery and can send SMS to N number of mobile numbers without even visiting the cuvva.com/cuvva.insure website. Reproduction Steps :...

Fedora 26 : wordpress (2017-fe7c3c9c30)

WordPress 4.7.5 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.7.4 and earlier are affected by six security issues : - Insufficient redirect validation in the HTTP class. Reported by Ronni...

Zomato: Posting to Twitter CSRF on php/post_twitter_authenticate.php

Hi ! This time, i found a CSRF who can lead to arbitrary writing on twitter account of victim if they have added it to zomato : Coupled with a stored XSS, it could be very troublesome to you. In the page, it seems there is no token check at all. You can see in the video the CSRF working and here ...

CVE-2017-11193

Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker to run these comman...

Schneider Electric Pelco Sarix/Spectra Cameras CSRF Enable SSH Root Access

Summary Pelco offers the broadest selection of IP cameras designed for security surveillance in a wide variety of commercial and industrial settings. From our industry-leading fixed and high-speed IP cameras to panoramic, thermal imaging, explosionproof and more, we offer a camera for any...

CVE-2017-2244

CVE-2017-2244 concerns a cross-site request forgery (CSRF) in Brother MFC‑J960DWN printers. The vulnerability affects firmware version D and earlier of MFC‑J960DWN, enabling remote attackers to hijack the authentication of administrators via unspecified vectors. Connected documents consistently d...

XYHCMS_V3-20170614 CSRF and File Upload Vulnerabilities in the Backend

Xing Yunhai CMS XYHcms is a completely open source CMS content management system. XYHCMSV3-20170614 CSRF and file upload vulnerability exists in the background. Attackers can use this vulnerability to lure administrators to click on specially crafted links to further Getshell and gain control of...

CVE-2017-6042

A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Affected devices do not verify if a request was intentionally sent by the logged-in user, which may allow an attacker to trick a...

CVE-2017-10678

Cross-site request forgery CSRF vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request...

CVE-2017-10681

Cross-site request forgery CSRF vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock albums via a crafted request...

CVE-2017-10680

Cross-site request forgery CSRF vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a private album to public via a crafted request...

CVE-2017-9757

IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. This can be exploited directly by authenticated users, or through CSRF...

WonderCMS 2.1.0 - Cross-Site Request Forgery

document.forms0.submit; !-- Disclosure Timeline: --------------------- 2017-06-16: Vulnerability found. 2017-06-17: Reported to vendor. 2017-06-17: Vendor responded and send a new version for test in it. 2017-06-17: Test new version and vulernability patched successfully. 2017-06-18: Vendor...

CVE-2016-1000218

Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports whenever an authenticated Kibana user navigates to a specially-crafted page...

Cross site request forgery (csrf)

On D-Link DIR-605L devices, firmware before 2.08UIBetaB01.bin allows an unauthenticated GET request to trigger a reboot...

CVE-2017-9673

In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account via the index.php/user/new URI or change its settings via the index.php/user/1 URI, including its password...

CVE-2017-9673

In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account via the index.php/user/new URI or change its settings via the index.php/user/1 URI, including its password...

CVE-2017-9673

In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account via the index.php/user/new URI or change its settings via the index.php/user/1 URI, including its password...

Cross site request forgery (csrf)

In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account via the index.php/user/new URI or change its settings via the index.php/user/1 URI, including its password...

Serendipity < 2.1.1 Multiple Vulnerabilities

According to its banner, the version of Serendipity running on the remote host is prior to 2.1.1. It is, therefore, affected by multiple vulnerabilities : - A stored cross-site scripting XSS vulnerability exists in the templates/2k11/admin/category.inc.tpl script due to improper validation of the...