LuxCal 3.2.2 Cross Site Request Forgery / SQL Injection

Author: TUNISIAN CYBER + Exploit Title: LuxCal v3.2.2 CSRF/Blind SQL Injection Vulnerabilities + Date: 09-03-2014 + Category: WebApp + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-352/CWE-89 + Vendor: http://www.luxsoft.eu/ + Friendly Sites: na3il.com,th3-creative.com + Twitter: @TCYB3R...

Eventy Plus Cross Site Request Forgery

Author: TUNISIAN CYBER + Exploit Title: Eventy Plus Cross-Site Request Forgery Add Admin Vulnerability + Date: 03-03-2014 + Category: WebApp + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-352 + Vendor: http://calendarscripts.info/ + Friendly Sites: na3il.com,th3-creative.com + Twitter: @TCYB3R...

Savsoft Quiz Cross Site Request Forgery

Author: TUNISIAN CYBER + Exploit Title: Savsoft Quiz Cross-Site Request Forgery Add Admin Vulnerability + Date: 24-02-2014 + Category: WebApp + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-352 + Vendor: http://savsoftquiz.com/web/buy-now/ + Friendly Sites: na3il.com,th3-creative.com 1.OVERVIEW:...

Savsoft Quiz Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications + Author: TUNISIAN CYBER + Exploit Title: Savsoft Quiz Cross-Site Request Forgery Add Admin Vulnerability + Date: 24-02-2014 + Category: WebApp + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-352 + Vendor: http://savsoftquiz.com/web/buy-now/ +...

D-Link DIR-100 CSRF / XSS / Disclosure / Authentication

Title: Router D-Link DIR-100 Multiple Vulnerabilities Date: 2013-12-18 Author: Felix Richter Contact: [email protected] Vulnerable Software: ftp://ftp.dlink.de/dir/dir-100/driversoftware/DIR-100fwrevd403b07ALLde20120410.zip Patched Software:...

Tyler Technologies TaxWeb 3.13.3.1 contains multiple vulnerabilities

Overview Tyler Technologies TaxWeb 3.13.3.1 and possibly earlier versions contain cross-site request forgery CWE-352, information exposure CWE-203, and reflected cross-site scripting CWE-79 vulnerabilities. Description CWE-352: Cross-Site Request Forgery CSRF - CVE-2013-6018TaxWeb 3.13.3.1...

Brickcom 100ap Series Authentication Bypass / CSRF

============================================================================ BRICKCOM ==================================================================== ============================================================================ 1.Advisory Information Title: Brickcom 100ap Series Vulnerabiliti...

QNAP VioStor NVR firmware version 4.0.3 and QNAP NAS multiple vulnerabilities

Overview QNAP VioStor NVR firmware version 4.0.3 and possibly earlier versions and QNAP NAS contains multiple vulnerabilities which may allow an attacker to perform administrative functions against the hosted server. Description QNAP VioStor NVR firmware version 4.0.3 and possibly earlier version...

CMS Made Simple 1.11.2 Cross Site Request Forgery

Advisory ID: HTB23121 Product: CMS Made Simple Vendor: cmsmadesimple.org Vulnerable Versions: 1.11.2 and probably prior Tested Version: 1.11.2 Vendor Notification: October 17, 2012 Public Disclosure: November 7, 2012 Vulnerability Type: Cross-Site Request Forgery CWE-352 CVE Reference:...

CMS Made Simple 1.11.2 Cross Site Request Forgery Vulnerability

CMS Made Simple version 1.11.2 suffers from a cross site request forgery vulnerability. Product: CMS Made Simple Vendor: cmsmadesimple.org Vulnerable Versions: 1.11.2 and probably prior Tested Version: 1.11.2 Vendor Notification: October 17, 2012 Public Disclosure: November 7, 2012 Vulnerability...

Cerberus FTP Server web interface cross-site request forgery vulnerability

Overview The Cerberus FTP Server web interface contains a cross-site request forgery vulnerability Description CWE-352: Cross-Site Request Forgery CSRF: The Cerberus FTP Server web interface is vulnerable to CSRF using the HTTP POST method in the :10000/usermanager/users/modify. The application h...

CVE-2012-2216 - Social Engine Multiples Vulnerabilities (XSS and CSRF)

Social Engine 4.2.2 Multiples Vulnerabilities Earlier versions are also possibly vulnerable. INFORMATION Product: Social Engine 4.2.2 Remote-Exploit: yes Vendor-URL: http://www.socialengine.net/ Discovered by: Tiago Natel de Moura aka "i4k" Discovered at: 10/04/2012 CVE Notified: 10/04/2012 CVE...

Quantum Scalar i500, Dell ML6000 and IBM TS3310 tape libraries web interface and preconfigured password vulnerabilities

Overview Cross scripting and preconfigured password vulnerabilities have been reported to exist in the Quantum Scalar i500, Dell ML6000 and IBM TS3310 tape libraries. Description Quantum Scalar i500, Dell ML6000 and IBM TS3310 enterprise tape libraries contain multiple web interface and...

Support Incident Tracker multiple vulnerabilities

Overview Support Incident Tracker or SiT! version 3.65, and possibly earlier versions, contain multiple vulnerabilities including; malicious file uploads, SQL injection, cross-site scripting, and cross-site request forgery. Description According to the SiT! website:"Support Incident Tracker or Si...

Core Security Technologies Advisory 2010.1021

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://corelabs.coresecurity.com/ IBM WebSphere Application Server Cross-Site Request Forgery 1. Advisory Information Title: IBM WebSphere Application Server Cross-Site Request Forgery Advisory ID:...

PHP MicroCMS 1.0.1 - Cross-Site Request Forgery / Cross-Site Scripting

Vulnerability ID: HTB22765 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpmicrocms.html Product: PHP MicroCMS Vendor: ApPHP http://www.apphp.com/ Vulnerable Version: 1.0.1 and probably prior versions Vendor Notification: 21 December 2010 Vulnerability Type: CSRF Cross-Site Request Forger...

Sun Solaris 10 ftpd Cross-site request forgery

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sun Solaris 10 ftpd Cross-site request forgery Author: Maksymilian Arciemowicz SecurityReason.com Date: - - Dis.: 24.02.2010 - - Pub.: 21.05.2010 Affected Software: - - Sun Solaris 10 10/09 - - OpenSoalris 2009.06 Original URL:...

Sun Solaris 10 ftpd Cross Site Request Forgery

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sun Solaris 10 ftpd Cross-site request forgery Author: Maksymilian Arciemowicz SecurityReason.com Date: - - Dis.: 24.02.2010 - - Pub.: 21.05.2010 Affected Software: - - Sun Solaris 10 10/09 - - OpenSoalris 2009.06 Original URL:...

Unsafe usage of unserialize function.

PMASA-2010-3 Announcement-ID: PMASA-2010-3 Date: 2010-01-15 Updated: 2010-01-27 Summary Unsafe usage of unserialize function. Description phpMyAdmin used the unserialize PHP function on potentially unsafe data in setup script, what could be potentially used for XSRF attack, which can lead to code...

XSRF/CSRF for creating a database and modifying user charset

PMASA-2008-5 Announcement-ID: PMASA-2008-5 Date: 2008-07-15 Updated: 2008-07-16 Summary XSRF/CSRF for creating a database and modifying user charset Description We received an advisory from Aung Khant YGN Ethical Hacker Group, and we wish to thank him for his work. A logged-in user, if abused int...