WordPress Lazy Content Slider 3.4 Cross Site Request Forgery

Exploit Title : WordPress Lazy content Slider Plugin - CSRF Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : https://wordpress.org/support/view/plugin-reviews/lazy-content-slider Category: Webapps Tested on: Win Version: 3.4 Date: 2016/07/08 PoC: The vulnerable page is...

WordPress Plugin Lazy Content Slider 3.4 - Cross-Site Request Forgery (Add Catetory)

Exploit Title : WordPress Lazy content Slider Plugin - CSRF Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : https://wordpress.org/support/view/plugin-reviews/lazy-content-slider Category: Webapps Tested on: Win Version: 3.4 Date: 2016/07/08 PoC: The vulnerable page is...

Fortinet FortiWeb CSRF Vulnerability (FG-IR-16-010)

Fortinet FortiWeb is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-1228

Cross-site request forgery CSRF vulnerability on NTT EAST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1006 and earlier and NTT WEST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1005 and earlier allows remote attackers to hijack the...

CVE-2016-2082

CVE-2016-2082 affects VMware vRealize Log Insight 2.x and 3.x prior to 3.3.2. The issue is a cross-site request forgery (CSRF/XSRF) vulnerability that can hijack an authenticated user’s session. The root cause is insufficient CSRF protection for certain actions. A remediation present in the conne...

Siemens Patches Password Reconstruction Vulnerability in SICAM PAS

The Industrial Control Systems Cyber Emergency Response Team ICS-CERT cautioned users who work in electrical substations to update certain builds of energy automation software this week. ICS-CERT claims two vulnerabilities exist in the Siemens SICAM Power Automation System, or PAS, that could...

CVE-2016-2901

Cross-site request forgery CSRF vulnerability in the PAThemeCreator application in IBM WebSphere Portal 8.5 CF08 through CF10 and Web Content Manager allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Yona CMS 1.3.x Cross Site Request Forgery

Exploit Title: Yona CMS document.forms0.submit;...

Airia - Cross-Site Request Forgery (Add Content)

Exploit for php platform in category web applications document.forms.csrfpoc.submit; 0day.today 2018-02-19...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on I-O DATA DEVICE ETX-R devices allows remote attackers to hijack the authentication of arbitrary users...

SlimCMS 0.1 - Cross-Site Request Forgery (Change Admin Password)

SlimCMS 0.1 - Cross-Site Request Forgery Change Admin Password input type="hidden" name="theme" value=...

Uber: Newsroom.uber HTML form without CSRF protection

Hi, The link that exists CSRF vulnerability https://newsroom.uber.com/india/how-to-refer/ Attack details Form name: Empty Form action: https://newsroom.uber.com/india/wp-login.php?action=postpass&wpe-login=ubernewblog Form method: POST Reproduction Steps 1-Create a file named submit.html 2-Write...

CVE-2016-4494

Cross-site request forgery CSRF vulnerability on KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of unspecified victims for requests that disclose the contents of a configuration file...

AjaxExplorer 1.10.3.2 - Multiple Vulnerabilities

Exploit for php platform in category web applications + Credits: hyp3rlinx + ISR: apparitionsec Vendor: ========== sourceforge.net smsid download linx: sourceforge.net/projects/ajax-explorer/files/ Product: ======================= AjaxExplorer v1.10.3.2 Manage server files through simple windows...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on Moxa MiiNePortE14641 devices with firmware 1.1.10 Build 09120714, MiiNePortE17080 devices with firmware 1.1.10 Build 09120714, MiiNePortE21242 devices with firmware 1.1 Build 10080614, MiiNePortE24561 devices with firmware 1.1 Build 10080614, and...

CVE-2016-4506

The CVE-2016-4506 CSRF vulnerability affects Resource Data Management’s Intuitive 650 TDB Controller before version 2.1.24. A CSRF condition could allow a remote authenticated user to perform actions in the context of the target user, with impact described as high for confidentiality, integrity, ...

ESF pfSense status_rrd_graph_img.php Command Injection

A Command Injection vulnerability has been reported in ESF pfSense. This vulnerability is due to statusrrdgraphimg.php incorrectly validating the graph HTTP parameter. A remote, authenticated attacker can exploit this vulnerability by sending crafted requests to the statusrrdgraphimg.php URI...

Moxa MiiNePort Devices Leak Data, Open to Unauthorized Access

Embedded device servers made by Moxa remain vulnerable to a trio of vulnerabilities disclosed today in an advisory published by the Industrial Control Systems Cyber Emergency Response Team ICS-CERT and a blog post by researcher Karn Ganeshen. Moxa, which is based in Taiwan, will publish a beta...

Debian DLA-485-1 : extplorer security update

This security update fixes a security issue in extplorer. We recommend you upgrade your extplorer package. - CVE-2015-5660 Cross-site request forgery CSRF vulnerability allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code. NOTE: Tenable Networ...

CVE-2016-2157

Cross-site request forgery CSRF vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage...