10425 matches found
CVE-2014-4636
EMC Documentum Web Development Kit (WDK) prior to version 6.8 is affected by a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2014-4636). The issue allows an attacker to trick authenticated users into performing Docbase operations with their privileges by visiting a malicious link or page, ...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the Our Team Showcase our-team-enhanced plugin before 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site...
CVE-2014-2598
The CVE-2014-2598 entry documents a CSRF/XSS vulnerability in the WordPress plugin Quick Page/Post Redirect Plugin (affected versions: before 5.0.5). The issue arises from handling of the quickppr_redirects[request][] parameter on the redirect-updates admin page (wp-admin/admin.php), enabling an ...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct cross-site scripting XSS attacks via th...
CVE-2014-9459
Summary of CVE-2014-9459 (e107 CMS) : A CSRF vulnerability in the AdminObserver function of e107(2.0 alpha2) affects e107_admin/users.php, allowing a remote attacker to hijack administrator authentication by tricking a logged-in admin into performing an action that adds a user to the administrato...
CVE-2011-5315
Cross-site request forgery CSRF vulnerability in admin/index.php in whCMS 0.115 alpha allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...
CVE-2011-5284
CVE-2011-5284 describes a Cross-site Request Forgery vulnerability in Smoothwall Express 3.1 and 3.0 SP3 and earlier, specifically in the web management interface’s httpd/cgi-bin/shutdown.cgi. The vulnerability allows an attacker to hijack an administrator’s authenticated session to perform reboo...
CVE-2014-6168
Cross-site request forgery CSRF vulnerability in IBM Security Identity Manager 5.1 before 5.1.0.15 IF0056 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a saveuser action...
CVE-2012-1203
The CVE-2012-1203 entry describes a CSRF vulnerability in SyndeoCMS (starnet/index.php) affecting version 3.0 and earlier. The underlying issue is CSRF that allows remote attackers to hijack an administrator’s session to perform add-user actions via a save_user request. Affected component/file: s...
e107 2.0 Alpha2 Cross Site Request Forgery
Advisory: CSRF vulnerability in CMS e107 v.2 alpha2 Advisory ID: SROEADV-2014-04 Author: Steffen Rösemann Affected Software: CMS e107 v.2 alpha2 Release-Date: 08th-Jun-2014 Vendor URL: http://e107.org Vendor Status: solved CVE-ID: - ========================== Vulnerability Description:...
CVE-2014-5217
Cross-site request forgery CSRF vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword...
CVE-2014-5217
Cross-site request forgery CSRF vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword...
W3TotalFail: W3 Total Cache v 0.9.4 CSRF Vulnerability that Leads to Full Deface
Title: W3TotalFail: W3 Total Cache v 0.9.4 CSRF Vulnerability that Leads to Full Deface Author: Mazin Ahmed Date of Discovering: October 6th, 2014 Date of Reporting to the Vendor: October 7th, 2014 Date of Releasing a Patch: December 9th, 2014 Vulnerability Type: Cross-Site Request Forgery CSRF -...
CVE-2014-9368
Affected software: WordPress twitterDash plugin, version 2.1 and earlier. Vulnerability: CSRF that allows remote attackers to hijack administrator authentication and trigger stored XSS via the username_twitterDash parameter in twitterDash.php directing requests to wp-admin/options-general.php. Im...
CVE-2014-6077
Cross-site request forgery CSRF vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...
Hidden in the Share button in the attack: Blogger. com exposure of high-risk CSRF（cross-site request forgery）vulnerability-vulnerability warning-the black bar safety net
The Egyptian security expert Mazen shows Gamal Mesbah on Blogger. com found a high risk of CSRF（cross-site request forgery）vulnerabilities. The vulnerability can allow an attacker in blogger without the knowledge of writing and publishing blogs, while the private blog public. Blogger is Google's...
CVE-2014-8246
Cross-site request forgery CSRF vulnerability in CA Release Automation formerly iTKO LISA Release Automation before 4.7.1 b448 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
CVE-2014-8246
CA Release Automation (formerly iTKO LISA Release Automation) contains a CSRF vulnerability in CVE-2014-8246 affecting versions up to 4.7.1 Build 413; 4.7.1 Build 448 fixes the issue. The vulnerability allows a remote attacker to perform privileged actions by hijacking an authenticated session vi...
