Tenda A32 Router - CSRF Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Tenda A32 Router CSRF Vulnerabilityreboot the Router CVE ID :CVE-2014-7281 Date: 2014-10-10 Exploit Author: zixian Vendor Homepage: http://tenda.com.cn/ Software Link: http://tenda.com.cn/Catalog/Product/325 Version:...

RBS Change Complet Open Source 3.6.8 - CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: RBS Change Complet Open Source CSRF Google Dork: intext:"une réalisation rbs" Date: 10/01/2014 Exploit Author: KrustyHack Vendor Homepage: http://www.rbschange.fr/ Software Link:...

OpenFiler 2.99.1 - Cross-Site Request Forgery

DoS...

DouPHP可CSRF脱裤

简要描述： DouPHP可CSRF脱裤。 详细说明： 在www\admin\backup.php： if $rec == 'backup' $fileid = isset$REQUEST'fileid' ? $REQUEST'fileid' : 1; $tables = $REQUEST'tables'; $volsize = $REQUEST'volsize'; $totalsize = $REQUEST'totalsize'; $filename = $REQUEST'filename'; //1、用户输入的文件作为备份文件名 // 判断备份文件名是否规范 if...

CVE-2014-4816

Cross-site request forgery CSRF vulnerability in the Administrative Console in IBM WebSphere Application Server WAS 6.x through 6.1.0.47, 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 allows remote authenticated users to hijack the authentication of arbitrary users for requests...

Glype Proxy 1.4.9 Cross Site Request Forgery

------------------------------------------------------------------------ Glype proxy privacy settings can be disabled via CSRF ------------------------------------------------------------------------ Securify, September 2014 ------------------------------------------------------------------------...

M/Monit 3.2.2 Cross Site Request Forgery Vulnerability

M/Monit versions 3.2.2 and below suffer from multiple cross site request forgery vulnerabilities. Application: M/Monit 3.2.2 Author: Dolev Farhi @dolevff Date: 13.9.2014 Relevant CVEs: CVE-2014-6409, CVE-2014-6607 Vulnerable version: CSRF poc M/monit 3. Mitigation Software vendor confirmed the...

Avira Vulnerability Puts Users' Online Backup Data At Risk

A popular Anti-virus software Avira that provides free security software to its customers with Secure Backup service is vulnerable to a critical web application vulnerability that could allow an attacker to take over users’ account, putting millions of its users’ account at risk. Avira is very...

ecshop最新版csrf 下载数据库

简要描述： 太阳底下 详细说明： 测试版本，最新的2.7.4 beta1 目测2.7.3所有版本也都没有token 没有新鲜事。翻了好几遍厂商漏洞列表，确实没看到有人提过。 备份数据库的功能。 请求如下：有一个token的字段，但是默认为空，服务端也没有检查该字段，直接为空就可以请求成功。 同样，厂商采用了使用referer的方式来防御csrf，只要为空就可以绕过。可以说是这种防御是没有效果的。 构造好exp，管理员点击之后，在web目录下生成用户可控文件名的sql文件。可以直接下载。 漏洞证明： https://images.seebug.org/upload/201409/12165...

CacheGuard-OS 5.7.7 - Cross-Site Request Forgery

CacheGuard-OS 5.7.7 - Cross-Site Request Forgery I. VULNERABILITY ------------------------- CSRF vulnerabilities in CacheGuard-OS v5.7.7 II. BACKGROUND ------------------------- CacheGuard is an All-in-One Web Security Gateway providing firewall, web antivirus, caching, compression, URL filtering...

CacheGuard-OS 5.7.7 - CSRF Vulnerability

Exploit for linux platform in category web applications I. VULNERABILITY ------------------------- CSRF vulnerabilities in CacheGuard-OS v5.7.7 II. BACKGROUND ------------------------- CacheGuard is an All-in-One Web Security Gateway providing firewall, web antivirus, caching, compression, URL...

CVE-2014-3037

Cross-site request forgery CSRF vulnerability in IBM Configuration Management Application aka VVC in IBM Rational Engineering Lifecycle Manager before 4.0.7 and 5.x before 5.0.1, Rational Software Architect Design Manager before 4.0.7 and 5.x before 5.0.1, and Rational Rhapsody Design Manager...

Invision Power Board (IP.Board) 3.x - Cross-Site Request Forgery / Token Hjiacking

Title: IP Board 3.x CSRF - Token hjiacking Date: 03.09.14 Version: = 3.4.6 Vendor: invisionpower.com Author: Piotr S. Video-PoC: https://www.youtube.com/watch?v=G5P21TA4DjY 1 Introduction Latest and propabbly previous IPB verions suffers on vulnerability, which allows attacker to steal CSRF token...

CVE-2014-6072: CSRF vulnerability in the Web Profiler

Affected Versions All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony WebProfiler bundle are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintaine...

CVE-2014-3061

Cross-site request forgery CSRF vulnerability in IBM Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2014-3040

Cross-site request forgery CSRF vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x before 10.0.0.1 iFix 10, 10.0.1.x before 10.0.1.4, and 10.0.2.x before 10.0.2.2 iFix 2; Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x before 10.0.0.1 iFix 10, 10.0.1.x before 10.0.1.4, and 10.0.2.x before 10.0.2.2 iFix 2; Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x...

Innovaphone PBX Admin-GUI - CSRF Vulnerability

Exploit for multiple platform in category web applications Title: Innovaphone PBX Admin-GUI CSRF Impact: High CVSS2 Score: 7.8 AV:N/AC:M/Au:S/C:P/I:C/A:C/E:F/RL:U/RC:C Announced: August 21, 2014 Reporter: Rainer Giedat NSIDE ATTACK LOGIC GmbH, www.nsideattacklogic.de Products: Innovaphone PBX...

MGASA-2014-0349 Updated bugzilla packages fix a CSRF vulnerability

Updated bugzilla packages fix security vulnerabilities: Adobe does not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery CSRF attacks against Bugzilla's JSONP endpoint, possibly obtaining sensitive bug information, via a crafted OBJECT...

CVE-2014-2633

Cross-site request forgery CSRF vulnerability in the server in HP Service Manager SM 7.21 and 9.x before 9.34 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...