CVE-2015-8152

CVE-2015-8152 affects Symantec Endpoint Protection Manager (SEPM) 12.1 up to RU6-MP4. The issue is a cross-site request forgery (CSRF) vulnerability in logging scripts that enables a remote authenticated attacker to hijack administrator authentication and execute arbitrary code through crafted lo...

New Relic: CSRF- delete all empty server policy

A CSRF vulnerability is found in the application, using which an attacker can delete all empty server policy. Steps to reproduce Create a html file using following code: send it to victim. Note : Make sure you change the account id to the victims id...

New Relic: CSRF - Delete all empty application policy

A CSRF vulnerability is found in the application, using which an attacker can delete all empty application policy. Steps to reproduce Create a html file using following code: send it to victim. Note : Make sure you change the account id to the victims id...

CVE-2015-7446

Cross-site request forgery CSRF vulnerability in IBM Flash System V9000 7.4 before 7.4.1.4, 7.5 before 7.5.1.3, and 7.6 before 7.6.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Ubiquiti Networks UniFi 3.2.10 - CSRF Vulnerability

No description provided by source...

Zimbra 8.0.9 GA - Cross-Site Request Forgery

Zimbra 8.0.9 GA - Cross-Site Request Forgery ====================================== Multiple CSRF in Zimbra Mail interface ====================================== CVE-2015-6541 Description =========== Multiple CSRF vulnerabilities have been found in the Mail interface of Zimbra 8.0.9 GA Release,...

Zimbra 8.0.9 GA - Cross-Site Request Forgery

====================================== Multiple CSRF in Zimbra Mail interface ====================================== CVE-2015-6541 Description =========== Multiple CSRF vulnerabilities have been found in the Mail interface of Zimbra 8.0.9 GA Release, enabling to change account preferences like...

CVE-2015-5050

Cross-site request forgery CSRF vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to hijack the authentication of...

JVN#64209269: Cybozu Office vulnerable to cross-site request forgery

Cybozu Office contains a cross-site request forgery vulnerability CWE-352 in multiple functions. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the Software Update to the latest version according to the information provided by the...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Adobe Connect before 9.5.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

McAfee Vulnerability Manager Enterprise Manager Component Cross-Site Request Forgery Vulnerability

McAfee Vulnerability Manager is a security risk management solution from McAfee USA. A cross-site request forgery vulnerability exists in the Organizations and Remediation administration page in the Enterprise Manager component of McAfee Vulnerability Manager, which allows remote attackers to...

KMC Controls Conquest BACnet Router Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on May 5, 2016, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified authentication and cross-site request forgery CSRF vulnerabilities in KMC Controls’ Conquest...

MGASA-2016-0051 Updated phpmyadmin/phpseclib packages fix security vulnerability

Password suggestion functionality uses Math.random which does not provide cryptographically secure random numbers CVE-2016-1927. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full pa...

CVE-2015-7537

CVE-2015-7537 affects Jenkins, described as a CSRF vulnerability that could allow an attacker to hijack admin authentication via HTTP GET. Affected versions: Jenkins before 1.640 and LTS before 1.625.2. Mitigation: upgrade to Jenkins 1.640 or newer or LTS 1.625.2 or newer. The connected advisory ...

Shopify: CSRF on https://shopify.com/plus

Hello. To reproduce this CSRF, visit https://www.shopify.com/plus?insppingurln=https://example.com/%23 Will be sent this post request on example.com: POST https://example.com/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:44.0 Gecko/20100101 Firefox/44.0 Accept: application/jso...

Zomato: Twitter Disconnect CSRF

Hi Using this CSRF vulnerability one could disconnect Twitter account from their profiles. Vulnerable request GET /php/disconnecttwitterprofile.php HTTP/1.1 Host: www.zomato.com Connection: keep-alive Accept: text/html, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 Windows NT...

Manage Engine Network Configuration Manager Build 11000 - Cross-Site Request Forgery

Exploit for multiple platform in category web applications ========================================================================================= Cross-Site Request Forgery Vulnerability in ManageEngine Network Configuration Management...

ManageEngine Network Configuration Management Build 11000 CSRF

Title:- Cross-Site Request Forgery CSRF Vulnerability in ManageEngine Network Configuration Management Author: Kaustubh G. Padwad Vendor: ZOHO Corp Product: ManageEngine Network Configuration Manager Tested Version: : Network Configuration Manager Build 11000 Severity: HIGH About the Product:...

jenkins: CSRF vulnerability in some administrative actions (SECURITY-225)

Cross-site request forgery CSRF vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method...

pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery

pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://192.168.0.103/diagbackup.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8";...