CVE-2016-8941

IBM Tivoli Storage Productivity Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2017-3794

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against an administrative user. More Information: CSCuz03317. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.12...

CMS Made Simple < 2.1.6 CSRF Vulnerability

CMS Made Simple is prone to a CSRF vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cmsmadesimple:cmsmadesimple"; i...

DEBIAN-CVE-2016-6897

Cross-site request forgery CSRF vulnerability in the wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the checkajaxreferer...

CVE-2017-5492

CVE-2017-5492 is a CSRF/vulnerability in WordPress 4.x where the widget-editing accessibility-mode feature could be abused to hijack a user’s authenticated session via actions in widgets (related to wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php). Affected versions before 4.7.1 ar...

CVE-2017-5473

Cross-site request forgery CSRF vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/adduser.lua, admin/changeuserprefs.lua, admin/deleteuser.lua, and admin/passwordreset.lua...

Cross site request forgery (csrf)

Web2py versions 2.14.5 and below was affected by CSRF Cross Site Request Forgery vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just by sending a URL to victim...

Huawei Flybox B660 - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Document Title: =============== Huawei Flybox B660 - POST Reboot CSRF Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2025 Release Date: ============= 2017-01-10 Vulnerability...

CVE-2015-4593

eClinicalWorks Population Health CCMR suffers from a cross-site request forgery CSRF vulnerability in portalUserService.jsp which allows remote attackers to hijack the authentication of content administrators for requests that could lead to the creation, modification and deletion of users,...

BSA-2016-209

Security Advisory ID : BSA-2016-209 Component : Web UI Revision : 1.0: Final A CSRF vulnerability in Brocade Virtual Traffic Manager versions released prior to and including 11.0, could allow an attacker to trick a logged-in user into making administrative changes on the traffic manager cluster...

mycampus.uapb.edu XSS vulnerability

Vulnerable URL: https://mycampus.uapb.edu/web/mycampus/legal-disclaimer?ppid=58%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3Eplifecycle=0pstate=maximizedpmode=view=0&58strutsaction=%2Flogin%2FloginKNOXSS Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017...

ByREV WP-PICShield - Cross-Site Request Forgery (CSRF)

The ByREV WP-PICShield WordPress plugin is vulnerable to CSRF. When updating the plugin options, several parameters in the issued POST request are written directly to the .htaccess file within the WordPress root directory. An attacker may be able to insert arbitrary lines into the .htaccess file,...

WordPress Copy-Me 1.0.0 Cross Site Request Forgery

Details ================ Software: copy-me Version: 1.0.0 Homepage: http://wordpress.org/plugins/copy-me/ Advisory report: https://security.dxw.com/advisories/copy-me-vulnerable-to-csrf-allowing-unauthenticated-attacker-to-copy-posts/ CVE: Awaiting assignment CVSS: 4.3 Medium;...

CVE-2016-7454

CVE-2016-7454 affects Technicolor/Comms Cisco DPC3941T gateways (firmware dpc3941-P20-18-v303r20421733-160413a-CMCST). The vulnerability is a Cross-Site Request Forgery (CSRF) in the device’s admin interfaces that enables an attacker to change the Wi‑Fi password, open the remote management interf...

WordPress Plugin Quiz And Survey Master 4.5.4/4.7.8 - Cross-Site Request Forgery

alert1” in the questionname field then “question: ‘alert1’,” will get output inside the JS object. All good so far. However, in js/adminquestion.js on line 205, we see this line, as part of some JS-generated HTML: jQuery''.htmlquestionslisti.question.replace/"/g, '"'.replace/'/g,...

[SECURITY] [DLA 732-3] monit regression update

Package : monit Version : 1:5.4-2+deb7u3 Debian Bug : 847196 The update for monit issued as DLA-732-1 causes monit to segfault when using the collector function meant to provide data to M/Monit. This update fixes the regression. For reference the original advisory text follows. Adith Sudhakar...

Ruby on Rails: CSRF header is sent to external websites when using data-remote forms

Looks like there is a regression in the fix for CVE-2015-1840 H1 report. The origin isn't being checked before adding a CSRF header to data-remote forms. I noticed this when checking out the new rails-ujs repo. Example Rails template: submit Example http://attacker.com app require "sinatra" optio...

CVE-2016-2963

Cross-site request forgery CSRF vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the Connections generic page...

CVE-2016-2963

Cross-site request forgery CSRF vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...