PHPfileNavigator 2.3.3 Cross Site Request Forgery

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPFILENAVIGATOR0812a.txt Vendor: ================================ pfn.sourceforge.net Product: =================================== PHPfileNavigator v2.3.3 pfn Is...

WordPress 3.8.1 / 3.8.2 / 4.2.2 Cross Site Request Forgery Vulnerability

A cross site request forgery vulnerability in the comment form of WordPress versions 3.8.1, 3.8.2, and 4.2.2 allows for administrative impersonation. Details ================ Software: WordPress Version: 3.8.1,3.8.2,4.2.2 Homepage: http://wordpress.org/ Advisory report:...

Hawkeye-G v3.0.1.4912 CSRF Vulnerability CVE-2015-2878

UPDATED CORRECTION + Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-HAWKEYEG0724.txt Vulnerability Type: =================== CSRF CVE Reference: ============== CVE-2015-2878 Vendor: =================== www.hexiscyber.com...

CVE-2015-2848

CVE-2015-2848 is a CSRF vulnerability in Honeywell Tuxedo Touch Controller, affecting all versions before 5.2.19.0_VA. A remote attacker can hijack the authentication of legitimate users to issue home-automation commands (e.g., door unlock) via forged requests. The issue is documented across mult...

CVE-2015-2848

Cross-site request forgery CSRF vulnerability in Honeywell Tuxedo Touch before 5.2.19.0VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command...

CVE-2015-2134

HP System Management Homepage (SMH) prior to version 7.5.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that allows an authenticated remote user to hijack another user’s session and perform actions on behalf of the victim. The HP Security Bulletin HPSBMU03409 (rev.1) lists CVE...

openSUSE Security Update : rubygem-jquery-rails (openSUSE-2015-501)

rubygem-jquery-rails was updated to fix one security issue. This security issue was fixed : - CVE-2015-1840: CSRF Vulnerability in jquery-ujs and jquery-rails bsc934795. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

CVE-2015-4460

CVE-2015-4460 describes a Cross‑Site Request Forgery (CSRF) in B.A.S C2Box prior to 4.0.0 (r19171) that lets an unauthenticated attacker hijack an administrator’s session to add an admin account via SecuritySetting/UserSecurity/UserManagement.aspx, potentially compromising the domain. Connected s...

CVE-2015-4274

Cisco Unified Intelligence Center (UC) web framework versions 10.0(1)–10.6(1) are affected by a Cross-Site Request Forgery (CSRF) vulnerability that can let remote attackers hijack user sessions and perform arbitrary actions within the context of an authenticated user. The root cause is insuffici...

CVE-2015-4267

Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) are affected by a CSRF vulnerability in the web framework due to insufficient CSRF protections. The CVE describes that remote attackers could hijack the authentication of arbitrary users, with an u...

CVE-2015-4257

Cross-site request forgery CSRF vulnerability on Cisco TelePresence MCU 4500 devices with software 4.51.55 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90710...

CVE-2015-4258

The CVE-2015-4258 CSRF vulnerability affects Cisco TelePresence MSE 8000 Series. The issue arises from insufficient CSRF protection, enabling unauthenticated remote attackers to trick users into performing actions within the web interface, effectively hijacking user sessions. Affected component i...

CVE-2015-4252

The CVE-2015-4252 issue affects Cisco TelePresence ISDN Gateway devices (software 2.2(1.106)). The root cause is CSRF protection weakness that could allow an unauthenticated, remote attacker to perform actions within a user’s context, effectively hijacking authentication. Multiple connected sourc...

CVE-2015-4242

The CVE-2015-4242 issue affects Cisco FireSIGHT System Software 5.4.1.2 and 6.0.0 within FireSIGHT Management Center. Root cause: insufficient CSRF protections, enabling cross-site request forgery. Impact: remote attackers could hijack the authentication of arbitrary users and perform unauthorize...

UBUNTU-CVE-2015-3658

The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to...

CVE-2015-0115

Cross-site request forgery CSRF vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to hijack the authentication of customer accounts...

C2Box 4.0.0 r19171 Cross Site Request Forgery

Please add this advisory to your archive. Thanks. Title: Cross-Site Request Forgery CSRF Vulnerability in C2Box application Allows adding an Admin User or reset any user's password. Author: Wissam Bashour - Help AG Middle East Vendor: boxautomationB.A.S Product: C2Box Version: All versions below...

Hotels.com Phishing Scam Duping Travelers

An undisclosed number of travelers who use Hotels.com may have been victims of a phishing scheme. The company said some customers were recently tricked into disclosing their names, phone numbers, email addresses and travel bookings. An individual was reportedly able to convince customers that the...

CVE-2015-4586

The CVE-2015-4586 entry concerns the Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL router with firmware 1.0.0.20h.HOL. A Cross-Site Request Forgery (CSRF) vulnerability in the device’s web interface can allow an attacker to hijack administrator authentication and perform actions such as creating ...

Trio of Vulnerabilities Patched in Magneto Web App

A trio of vulnerabilities were recently patched in eBay’s Magento e-commerce web application that could have let attackers carry out a handful of exploits, including phishing, session hijacking, and data interception. Hadji Samir, a researcher at the firm Vulnerability Lab dug up the problems...