CVE-2012-6064

CMS Made Simple (CMSMS) versions prior to 1.11.2.1 are affected by CVE-2012-6064 due to a directory traversal vulnerability in lib/filemanager/imagemanager/images.php. The flaw allows remote authenticated administrators to delete arbitrary files via a deld parameter, and can be leveraged with CSR...

Symantec Messaging Gateway < 10.0 CSRF Vulnerability

Symantec Messaging Gateway is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Symantec Messaging Gateway 9.5.3-3 CSRF Vulnerability

Symantec Messaging Gateway version 9.5.3-3 suffers from a cross site request forgery vulnerability. ======= Summary ======= Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator for example Release Date: 30 November 2012 Reference: NGS00263 Discoverer: Ben Williams Vendor:...

Symantec Messaging Gateway 9.5.3-3 Cross Site Request Forgery

======= Summary ======= Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator for example Release Date: 30 November 2012 Reference: NGS00263 Discoverer: Ben Williams Vendor: Symantec Vendor Reference: Systems Affected: Symantec Messaging Gateway 9.5.3-3 Risk: High Status:...

PT-2012-1581 · Red Hat +1 · Jboss Enterprise Portal Platform +3

Name of the Vulnerable Software and Affected Versions: JBoss Enterprise Portal Platform versions prior to 5.2.2 BRMS Platform 5.3.0 before roll up patch 1 SOA Platform 5.3.0 before roll up patch 1 Description: A cross-site request forgery CSRF issue exists in the JMX Console, allowing remote...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack the authentication of arbitrary users...

CVE-2012-4935

Cross-site request forgery CSRF vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack the authentication of arbitrary users...

CVE-2012-4853

Cross-site request forgery CSRF vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger information disclosure...

CVE-2012-4734

Request Tracker RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state" via unknown vectors related to a crafted link...

Debian DSA-2567-1 : request-tracker3.8 - several vulnerabilities

Several vulnerabilities were discovered in Request Tracker RT, an issue tracking system. - CVE-2012-4730 Authenticated users can add arbitrary headers or content to mail generated by RT. - CVE-2012-4732 A CSRF vulnerability may allow attackers to toggle ticket bookmarks. - CVE-2012-4734 If users...

CVE-2011-5223

The provided documents confirm CVE-2011-5223 is a CSRF vulnerability in Cacti’s logout.php affecting versions before 0.8.7i. Affected component is Cacti (web interface); the underlying issue is CSRF that can hijack a user’s authenticated session. The exact exploit vectors, affected product versio...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcmsodevelopername parameter in a save action to...

CVE-2012-4002

CVE-2012-4002 affects GLPI-PROJECT GLPI before 0.83.3, where a Cross-Site Request Forgery (CSRF) vulnerability could allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. The issue is documented across multiple sources, with NVD assigning a CVSS v2 base s...

CVE-2012-5326

CVE-2012-5326 affects IDevSpot iSupport 1.x. The vulnerability is a CSRF in admin/function.php that allows remote attackers to hijack administrator authentication to perform actions that add administrator accounts. The connected documents provide the same description and do not specify exploitati...

CVE-2012-5323

Cross-site request forgery CSRF vulnerability in webconfig/adminpasswd/passwd.html/adminpasswd in Xavi X7968 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysUserName, sysPassword, and sysCfmPwd parameters...

CVE-2012-5320

Cross-site request forgery CSRF vulnerability in password.cgi in Sagem F@ST 2604 253180972B allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in setup/security.cgi in D-Link DCS-900, DCS-2000, and DCS-5300 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the rootpass parameter...

CVE-2012-5323

Cross-site request forgery CSRF vulnerability in webconfig/adminpasswd/passwd.html/adminpasswd in Xavi X7968 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysUserName, sysPassword, and sysCfmPwd parameters...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in manager/news.php in Plume CMS 1.2.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that create News pages via a publish action...

CVE-2012-1414

The CVE-2012-1414 entry relates to a Cross-site request forgery (CSRF) vulnerability in Plume CMS, specifically in the file manager/news.php for version 1.2.4 and earlier. The issue allows remote attackers to hijack the authentication of administrators when performing publish actions that create ...