CVE-2014-5241

The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site...

Innovaphone PBX Cross Site Request Forgery Vulnerability

Innovaphone PBX suffers from cross site request forgery vulnerabilities in the administrative user interface. Title: Innovaphone PBX Admin-GUI CSRF Impact: High CVSS2 Score: 7.8 AV:N/AC:M/Au:S/C:P/I:C/A:C/E:F/RL:U/RC:C Announced: August 21, 2014 Reporter: Rainer Giedat NSIDE ATTACK LOGIC GmbH,...

Innovaphone PBX Cross Site Request Forgery

Title: Innovaphone PBX Admin-GUI CSRF Impact: High CVSS2 Score: 7.8 AV:N/AC:M/Au:S/C:P/I:C/A:C/E:F/RL:U/RC:C Announced: August 21, 2014 Reporter: Rainer Giedat NSIDE ATTACK LOGIC GmbH, www.nsideattacklogic.de Products: Innovaphone PBX Administration GUI Affected Versions: all known versions teste...

CVE-2014-5204

wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack...

Hacking Fiverr.com Accounts — Vulnerability Puts $50 Million Company At Risk

Fiverr.com, a global online marketplace which provides a platform for people to sell their services for five dollars per job, is vulnerable to a critical web application vulnerability that puts its millions of users at risk. Fiverr recently raised $30 million in a third round of institutional...

CVE-2014-5199

CVE-2014-5199 is a CSRF vulnerability in the WordPress File Upload plugin (wp-file-upload) for WordPress, affecting versions before 2.4.2. The issue allows remote attackers to hijack the administrator’s authentication for requests that change plugin settings via unspecified vectors. Root cause is...

CVE-2014-5196

The CVE-2014-5196 entry details a CSRF vulnerability in the WordPress plugin Improved User Search in Backend (backend) prior to version 1.2.5. The flaw resides in the iusib_meta_fields parameter, enabling remote attackers to hijack administrator authentication by injecting XSS sequences. Affected...

CVE-2014-3854

Cross-site request forgery CSRF vulnerability in admin/addScript.py in Pyplate 0.08 allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the title parameter...

Cmseasy建站系统csrf获取管理权限后台getshell

简要描述： Cmseasy建站系统csrf获取管理权限后台getshell 详细说明： 在修改管理密码处存在csrf漏洞 http://localhost/cmseasy/uploads/index.php?case=table&act=edit&table=user&id=1&admindir=admin&site=default post:...

Security Advisory-CSRF Vulnerability in Huawei HiLink Products

Several Huawei HiLink products have the CSRF Vulnerability. When users use these devices to visit websites that contain malicious scripts, the malicious scripts can exploit the vulnerability to change the configurations or use the functions of products. Vulnerability ID: HWPSIRT-2014-0243 This...

AskApache Firefox Adsense 3.0 - Unspecified CSRF

The askapache-firefox-adsense WordPress plugin was affected by an Unspecified CSRF security vulnerability...

5star by Templatic - CSRF File Upload

Description The 5star WordPress theme was affected by a Templatic Theme CSRF File Upload security vulnerability. File Access: https://example.com/wp-content/themes/5star/images/tmp/yourshell.php...

Specialist by Templatic - CSRF File Upload

The specialist WordPress theme was affected by a Templatic Theme CSRF File Upload security vulnerability. File Access: https://example.com/wp-content/themes/specialist/images/tmp/yourshell.php...

Ubiquiti UbiFi / mFi / AirVision - CSRF Vulnerability

Exploit for hardware platform in category web applications function sendCSRF var urlbase = "https://192.168.0.106:8443/api/add/admin" var postdata="%7B%22name%22%3A%22csrf%22%2C%22lang%22%3A%22enUS%22%2C%22xpassword%22%3A%22csrf%22%7D" var xmlhttp; xmlhttp = new XMLHttpRequest; xmlhttp.open"POST"...

D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery / Denial of Service

Exploit Title: Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service Google dork : N/A Exploit Author: Blessen Thomas Date : 29/07/14 Vendor Homepage : http://www.dlink.com/ Software Link : N/A Firmware version: v2.02 2013-03-13 Tested on : Windows 7 CVE : CVE-2014-3136 Type of Application : Web...

Oxwall 1.7.0 - Multiple CSRF And HTML Injection Vulnerabilities

No description provided by source. !-- Oxwall 1.7.0 Multiple CSRF And HTML Injection Vulnerabilities Vendor: Oxwall Software Foundation Product web page: http://www.oxwall.org Affected version: 1.7.0 build 7907 and 7906 Summary: Oxwall is unbelievably flexible and easy to use PHP/MySQL social...

CVE-2014-2369

Summary (CVE-2014-2369) CSRF vulnerability in Omron NS series HMI terminals (NS5/NS8/NS10/NS12/NS15; firmware 8.1xx–8.68x) could allow a remote authenticated attacker to hijack a victim’s session. Root cause: inadequate request verification in the web application (CWE-352). CVSSv2 base scores: NV...

CVE-2014-2369 Omron NS Series HMI Cross-Site Request Forgery

Cross-site request forgery CSRF vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

UniFi / mFi / AirVision Cross Site Request Forgery

----------- Vendor: ----------- Ubiquiti Networks http://www.ubnt.com/ ----------------------------------------- Affected Products/Versions: ----------------------------------------- UniFi Controller v2.4.6 mFi Controller v2.0.15 AirVision Controller v2.1.3 Note: Previous versions may be affected...

OpenVPN Warns Customers of CSRF Bug in Access Server Desktop Client

OpenVPN is advising users of its Desktop Client to upgrade as soon as possible to avoid attacks against a CSRF vulnerability that can allow remote code execution. The vulnerability lies in a product that the company no longer supports and considers obsolete. An attacker could exploit the...