JVN#97278546: EC-CUBE vulnerable to cross-site request forgery

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page, arbitrary PHP code may be executed on the server. Solution Update or apply the patch Update to the...

JVN#92520335: eXtplorer vulnerable to cross-site request forgery

eXtplorer is a web-based file manager. index.php of eXtplorer contains a cross-site request forgery CWE-352 vulnerability. Impact If a user views a malicious page while logged in, the user may be forced to implicitly perform unintended operations such as the execution of arbitrary PHP code...

Popular Belkin Wi-Fi Routers vulnerable to Hackers

US-CERT has outlined about Wireless routers developed by Belkin supposedly containing several vulnerabilities. CERT in their Vulnerability Note VU201168 Vulnerability ID said, that Belkin’s N600 DB Wireless Dual-Band N+ Router, model F9K1102 v2 with firmware version 2.10.17 and very likely earlie...

Cerb 7.0.3 - Cross-Site Request Forgery

Cerb 7.0.3 - Cross-Site Request Forgery Advisory ID: HTB23269 Product: Cerb Vendor: Webgroup Media LLC Vulnerable Versions: 7.0.3 and probably prior Tested Version: 7.0.3 Advisory Publication: August 12, 2015 without technical details Vendor Notification: August 12, 2015 Vendor Patch: August 14,...

Cerb 7.0.3 - Cross-Site Request Forgery

Advisory ID: HTB23269 Product: Cerb Vendor: Webgroup Media LLC Vulnerable Versions: 7.0.3 and probably prior Tested Version: 7.0.3 Advisory Publication: August 12, 2015 without technical details Vendor Notification: August 12, 2015 Vendor Patch: August 14, 2015 Public Disclosure: September 2, 201...

Cerb 7.0.3 Cross Site Request Forgery

Advisory ID: HTB23269 Product: Cerb Vendor: Webgroup Media LLC Vulnerable Versions: 7.0.3 and probably prior Tested Version: 7.0.3 Advisory Publication: August 12, 2015 without technical details Vendor Notification: August 12, 2015 Vendor Patch: August 14, 2015 Public Disclosure: September 2, 201...

JVN#55076671: Cacti vulnerable to cross-site request forgery

Cacti is a web application that graphs stored data collected from network devices. Cacti contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the software Update to the latest...

Risk of BREACH attack due to reflected parameter.

PMASA-2015-1 Announcement-ID: PMASA-2015-1 Date: 2015-03-04 Summary Risk of BREACH attack due to reflected parameter. Description With a large number of crafted requests it was possible to infer the CSRF token by a BREACH attack. Severity We consider this vulnerability to be non critical...

WordPress Easy Social Icons Plugin 1.2.2 - CSRF Vulnerability

Exploit for php platform in category web applications ==================================================== Product: Easy Social Icons WordPress plugin Vendor: CyberNetikz Tested Version: 1.2.2 Vulnerability Type: XSS CWE-79 and CSRF CWE-352 Risk Level: Medium Solution Status: Solved in version...

WordPress Plugin Easy Social Icons 1.2.2 - Cross-Site Request Forgery

WordPress Plugin Easy Social Icons 1.2.2 - Cross-Site Request Forgery ==================================================== Product: Easy Social Icons WordPress plugin Vendor: CyberNetikz Tested Version: 1.2.2 Vulnerability Type: XSS CWE-79 and CSRF CWE-352 Risk Level: Medium Solution Status: Solv...

WordPress Plugin Easy Social Icons 1.2.2 - Cross-Site Request Forgery

==================================================== Product: Easy Social Icons WordPress plugin Vendor: CyberNetikz Tested Version: 1.2.2 Vulnerability Type: XSS CWE-79 and CSRF CWE-352 Risk Level: Medium Solution Status: Solved in version 1.2.3 Discovered and Provided: Eric Flokstra - ITsec...

WordPress Easy Social Icons 1.2.2 CSRF / XSS

==================================================== Product: Easy Social Icons WordPress plugin Vendor: CyberNetikz Tested Version: 1.2.2 Vulnerability Type: XSS CWE-79 and CSRF CWE-352 Risk Level: Medium Solution Status: Solved in version 1.2.3 Discovered and Provided: Eric Flokstra - ITsec...

CVE-2014-6077

CVE-2014-6077 is a CSRF vulnerability affecting IBM Security Access Manager for Mobile 8.0.x up to 8.0.0.5 and IBM Security Access Manager for Web 7.x up to FP10 (7.0.0.x) and 8.x up to 8.0.1. The issue allows an attacker to hijack the authentication of an arbitrary user via requests that insert ...

WordPress CM Download Manager 2.0.6 XSS / CSRF

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Product: WordPress plugin cm-download-manager Plugin page: https://wordpress.org/plugins/cm-download-manager/ Vendor: CreativeMindsSolutions http://cminds.com/ Vulnerability Type: CWE-79: Cross-site scripting Vulnerable Versions: 2.0.6 and below Fixed...

XSRF/CSRF due to DOM based XSS in the micro history feature

PMASA-2014-10 Announcement-ID: PMASA-2014-10 Date: 2014-09-13 Summary XSRF/CSRF due to DOM based XSS in the micro history feature Description By deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a...

LuxCal 3.2.2 - Multiple Vulnerabilities (CSRF/Blind SQL Injection)

No description provided by source. + Author: TUNISIAN CYBER + Exploit Title: LuxCal v3.2.2 CSRF/Blind SQL Injection Vulnerabilities + Date: 09-03-2014 + Category: WebApp + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-352/CWE-89 + Vendor: http://www.luxsoft.eu/ + Friendly Sites:...

Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability

No description provided by source. ANATOLIA SECURITY ADVISORY -------------------------------------- ADVISORY INFO + Title: Apache Archiva Cross-site Request Forgery Vulnerability + Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-001.txt + Advisory ID: 2010-001 + Versions: Archiva 1...

Сross-Site Request Forgery (CSRF) in XCloner Wordpress Plugin

Advisory ID: HTB23206 Product: XCloner Wordpress plugin Vendor: XCloner Vulnerable Versions: 3.1.0 and probably prior Tested Version: 3.1.0 Advisory Publication: March 12, 2014 without technical details Vendor Notification: March 12, 2014 Vendor Patch: March 13, 2014 Public Disclosure: April 2,...

XCloner Standalone 3.5 Cross Site Request Forgery Vulnerability

XCloner Standalone version 3.5 suffers from a cross site request forgery vulnerability. Product: XCloner Standalone Vendor: XCloner Vulnerable Versions: 3.5 and probably prior Tested Version: 3.5 Advisory Publication: March 14, 2014 without technical details Vendor Notification: March 14, 2014...

LuxCal 3.2.2 - Cross-Site Request Forgery / Blind SQL Injection

Author: TUNISIAN CYBER + Exploit Title: LuxCal v3.2.2 CSRF/Blind SQL Injection Vulnerabilities + Date: 09-03-2014 + Category: WebApp + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-352/CWE-89 + Vendor: http://www.luxsoft.eu/ + Friendly Sites: na3il.com,th3-creative.com + Twitter: @TCYB3R...