CVE-2016-6642

Cross-site request forgery CSRF vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to hijack the authentication of administrators for requests that upload files...

Zomato: CSRF in the "Add restaurant picture" function

Overview I found a CSRF vulnerability within the process responsible for adding photos for a restaurant which can lead to tricking victims into adding arbitrary photos to their restaurant's page. Details The CSRF vulnerability exists due to a misconfiguration on your part in which your X-CSRF-TOK...

Debian DSA-3668-1 : mailman - security update

It was discovered that there was a CSRF vulnerability in mailman, a web-based mailing list manager, which could allow an attacker to obtain a user's password. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian Security Advisory DSA 3668-1 (mailman - security update)

It was discovered that there was a CSRF vulnerability in mailman, a web-based mailing list manager, which could allow an attacker to obtain a user OpenVAS Vulnerability Test $Id: deb3668.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3668-1 using nvtgen 1.0 Script...

CSRF vulnerability in the latest version of beecms

beecms is an enterprise website management system based on PHP+Mysql architecture. The latest version of beecms has a CSRF vulnerability. Due to the failure of the add administrator form in the background to protect the token, adminadmin.php 102 lines to start processing add administrator, failed...

Jaws CMS v1.1.1 - Privilege Escalate CSRF Vulnerability

Document Title: =============== Jaws CMS v1.1.1 - Privilege Escalate CSRF Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1923 Release Date: ============= 2016-09-09 Vulnerability Laboratory ID VL-ID: ==================================== 19...

Jobberbase 2.0 Disclosure / XSS / Code Execution / Upload

Jobberbase: http://www.jobberbase.com/ Version: 2.0 By Ross Marks: http://www.rossmarks.co.uk 1 Local path disclosure - change any variable to an array and in most cases it will tell you the local path where the application is installed eg...

[SECURITY] [DLA 608-1] mailman security update

Package : mailman Version : 1:2.1.15-1+deb7u2 CVE ID : CVE-2016-6893 Debian Bug : 835970 It was discovered that there was a CSRF vulnerability in mailman, a web-based mailing list manager, which could allow an attacker to obtain a users password. For Debian 7 "Wheezy", this issue has been fixed i...

DLA-608-1 mailman - security update

Bulletin has no description...

CVE-2016-2998

Cross-site request forgery CSRF vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update data...

CVE-2016-4069

Cross-site request forgery CSRF vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service disk consumption via unspecified vectors...

CVE-2016-4069

Cross-site request forgery CSRF vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service disk consumption via unspecified vectors...

CVE-2016-6635

CVE-2016-6635 affects WordPress core: the CSRF flaw is in wp_ajax_wp_compression_test (wp-admin/includes/ajax-actions.php) in WordPress before 4.5, enabling remote attackers to hijack administrator sessions and change the script compression option. Affected: WordPress prior to 4.5. Impact: admin-...

New Relic: CSRF vulnerability that allows an attacker to purge plugin metric data

Vulnerability details A seemingly minor CSRF vulnerability exists in the endpoint that purges plugin metric data. When an admin visits the Agent overview of its account, it will show a button for each plugin that allows the admin to purge the data. This button links to a GET requests that is...

Open Upload Remote Cross-Site Request Forgery Vulnerability

Open Upload is an extensible PHP open source project for creating a private/public file download server . The Open Upload application suffers from a CSRF vulnerability, which can be exploited to lure an administrator user to a specially crafted URL via spear phishing or social engineering, allowi...

Typesettercms v5.0.1 - (Delete Files) CSRF Vulnerability

Document Title: =============== Typesettercms v5.0.1 - Delete Files CSRF Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1889 Release Date: ============= 2016-08-02 Vulnerability Laboratory ID VL-ID: ==================================== 188...

PayPal Fixes CSRF Vulnerability in PayPal.me

PayPal recently fixed a vulnerability on its PayPal.me site that could have let an attacker change a user’s profile without permission. The issue stemmed from a cross-site request forgery CSRF vulnerability that existed in PayPal.me, a site the company launched last year to let its users request...

NetApp Snap Creator Framework Cross-Site Request Forgery Vulnerability

NetApp Snap Creator Framework is the United States NetApp company's set of integrated NetApp functionality plug-ins and popular third-party applications framework. A cross-site request forgery vulnerability exists in versions of NetApp Snap Creator Framework prior to 4.3.P1, which can be exploite...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrar...

CVE-2016-2889

Cross-site request forgery CSRF vulnerability in the Report Builder and Data Collection Component DCC in IBM Jazz Reporting Service JRS 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrar...