Facebook and Dropbox in the CSRF vulnerability analysis-vulnerability warning-the black bar safety net

Facebook provides the user with a very handy feature, and the user can pass this option directly from the Dropbox account to load file: ! This feature will allow the user directly in the browser window to view and upload to the Dropbox account in the file: ! This functional integration is through...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in SetsucoCMS all versions allows remote attackers to hijack the authentication of an administrator to change settings via unspecified vectors...

CVE-2016-4891

CVE-2016-4891 is a CSRF vulnerability in SetucoCMS affecting all versions, enabling remote attackers to hijack an administrator’s session to change settings via unspecified vectors. The linked JVN entries confirm the issue and note the impact as unintended setting changes; multiple sources also r...

CSRF in Facebook/Dropbox - "Mallory added a file using Dropbox"

tl;dr Facebook Groups offers the option to upload files directly from the Dropbox account. This integration is done using the OAuth 2.0 protocol and suffered from a variant of the classic OAuth CSRF defined by Egor Homakov as the the Most Common OAuth2 Vulnerability, see video below: Introduction...

CVE-2015-8255

AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/localdel.cgi...

WordPress CopySafe Web Cross Site Request Forgery

Details ======= Software:CopySafe Web version: a a a a a ========= Mitigations ================ Disable the plugin until a new version is released that fixes this bug. Fixed ========= https://wordpress.org/plugins/wp-copysafe-web/ changelog -2.6 realease Best regards, Zhiyang Zeng of Tencent...

D-Link DIR-615 - Cross-Site Request Forgery

Title: ==== D-Link DIR 615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery CSRF vulnerability Credit: ====== Name: Pratik S. Shah Reference: ========= CVE Details: CVE-2017-7398. Date: ==== 1-04-2017 Vendor: ====== D-Link wireless router Product: ======= DIR-615...

Foswiki 1.0.x < 1.0.5 CSRF Vulnerability

Foswiki is prone to a cross-site request forgery CSRF vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

AXIS (Multiple Products) - Cross-Site Request Forgery

0RWELLL4BS security advisory olsa-CVE-2015-8255 PGP: 79A6CCC0 @orwelllabs Advisory Information ==================== - Title: Cross-Site Request Forgery - Vendor: AXIS Communications - Research and Advisory: Orwelllabs - Class: Session Management control CWE-352 - CVE Name: CVE-2015-8255 - Affecte...

Fedora 24 : deluge (2017-ce66f11df1)

Core 2889: Fixed 'Too many files open' errors. 2861: Added support for python-geoip for use with libtorrent 1.1. 2149: Fixed a single proxy entry being overwritten resulting in no proxy set. UI Added trackerstatus translation to UIs. GtkUI 2901: Strip whitespace from infohash before checks. Add...

CVE-2017-6366

Cross-site request forgery CSRF vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the hostname parameter to dnslookup.cgi. NOTE: this issue can be combined with...

CVE-2017-6180

Keekoon KK002 devices 1.8.12 HD have a Cross Site Request Forgery Vulnerability affecting goform/formChnUserPwd and goform/formUserMng and the entire set of other pages...

Western Digital My Cloud Command Injection

------------------------------------------------------------------------ Western Digital My Cloud vulnerable to multiple command injection vulnerabilities ------------------------------------------------------------------------ Remco Vermeulen, January 2017...

CVE-2017-5633

Multiple cross-site request forgery CSRF vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to 1 change the admin password, 2 reboot the device, or 3 possibly have unspecified other impact via crafted requests to CGI programs...

CVE-2015-8814

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery CSRF attacks as demonstrated by editing user account information in the templates.asmx.cs file...

WordPress File Manager 3.0.1 Cross Site Request Forgery

------------------------------------------------------------------------ Cross-Site Request Forgery in File Manager WordPress plugin ------------------------------------------------------------------------ David Vaartjes, July 2016...

CVE-2016-4311

Cross-site request forgery CSRF vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests via an entitlement/eval-policy-submit.jsp request...

CVE-2017-5145

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY CSRF vulnerability can allow execution of unauthorized actions on the device such as configuration parameter...

D-Link DIR-600M - Cross-Site Request Forgery

D-Link DIR-600M - Cross-Site Request Forgery Exploit Title:D-link wireless router DIR-600M – Cross-Site Request Forgery CSRF vulnerability Google Dork:N/A Date: 07/02/2017 Exploit Author:Ajay S. Kulal www.twitter.com/ajaykulal Vendor Homepage:dlink.com Software Link:N/A Version:Hardware version: ...

Dell SonicWALL SMA 100 / SRA Series CSRF Vulnerability (SNWLID-2015-0001)

Dell SonicWALL SMA 100 Series and SRA Series appliances are prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...