Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitra...

CVE-2015-5188

Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitra...

PT-2015-2597 · Red Hat · Red Hat Jboss Enterprise Application Platform +1

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Application Platform versions prior to 6.4.4 WildFly versions prior to 2.0.0.CR9 Description: A cross-site request forgery CSRF issue in the Web Console allows remote attackers to hijack the authentication of administrators...

EAP: CSRF vulnerability in EAP & WildFly Web Console

It was discovered that when uploading a file using a multipart/form-data submission to the EAP Web Console, the Console was vulnerable to Cross-Site Request Forgery CSRF. This meant that an attacker could use the flaw together with a forgery attack to make changes to an authenticated instance...

Drupal amoCRM module cross-site scripting vulnerability

Drupal is a free, open source content management system developed in PHP. amoCRM module for Drupal is a sales management Web service for Drupal. A cross-site scripting vulnerability in Drupal amoCRM module 7.x-1.2 before 7.x-1.x allows remote attackers to inject arbitrary web script or HTML via...

F5 BIG-IP - PHP vulnerability CVE-2015-4024

The remote host is missing a security patch. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if description...

WordPress Accurate Form Data Plugin <= 1.2 - Multiple Vulnerabilities

This plugin is prone to a cross site request forgery and cross site scripting vulnerabilities. Solution No fix available...

WordPress Accurate Form Data Plugin <= 1.2 - Multiple Vulnerabilities

This plugin is prone to a cross site request forgery and cross site scripting vulnerabilities. Solution No fix available...

WordPress WP Accurate Form Data 1.2 XSS / CSRF

Title: WordPress 'WP Accurate Form Data' Plugin Version: 1.2 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-21 Download: - https://wordpress.org/plugins/accurate-form-data-real-time-form-validation/ - https://plugins.svn.wordpress.org/accurate-form-data-real-time-form-validatio...

[USN-2658-1] PHP vulnerabilities

========================================================================== Ubuntu Security Notice USN-2658-1 July 06, 2015 php5 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...

Oracle Linux 6 : php (ELSA-2015-1218)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1218 advisory. - fix patch for CVE-2015-4024 - core: fix multipart/form-data request can use excessive amount of CPU usage CVE-2015-4024 - fix various functions accep...

php: multipart/form-data request parsing CPU usage DoS

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time...

php: multipart/form-data request parsing CPU usage DoS

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time...

php security update

5.3.3-46 - fix gzfile accept paths with NUL character 1213407 - fix patch for CVE-2015-4024 5.3.3-45 - fix more functions accept paths with NUL character 1213407 5.3.3-44 - soap: missing fix for 1222538 and 1204868 5.3.3-43 - core: fix multipart/form-data request can use excessive amount of CPU...

USN-2658-1: PHP vulnerabilities

Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. A remote attacker could possibly use this issue to bypass intended restrictions and create or obtain access to sensitive files. CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026, CVE-2015-4598...

USN-2658-1 php5 vulnerabilities

Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. A remote attacker could possibly use this issue to bypass intended restrictions and create or obtain access to sensitive files. CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026, CVE-2015-4598...

Endian Firewall 3.0.0 - OS Command Injection (Python)

Endian Firewall 3.0.0 - OS Command Injection Python !/usr/bin/env python Endian Firewall Proxy User Password Change /cgi-bin/chpasswd.cgi OS Command Injection Exploit POC Reverse TCP Shell Ben Lincoln, 2015-06-28 http://www.beneaththewaves.net/ Requires knowledge of a valid proxy username and...

php: multipart/form-data request parsing CPU usage DoS

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time...

php: multipart/form-data request parsing CPU usage DoS

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time...

php: multipart/form-data request parsing CPU usage DoS

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time...