6730 matches found
Cross-site request forgery
Administrate::ApplicationController actions don't have CSRF protection. Remote attackers can hijack user's sessions and use any functionality that administrate exposes on their behalf...
Apache Jetspeed Multiple Vulnerabilities (Mar 2016)
Apache Jetspeed is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:jetspeed"; if...
D-Link DVG-5402SP CSRF / Brute Force
Hello list! There are Brute Force, Abuse of Functionality and Cross-Site Request Forgery vulnerabilities in D-Link DVG-5402SP VoIP Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DVG-5402SP, Firmware RU1.01. Other versions also...
[SECURITY] Fedora 24 Update: php-pecl-http-2.5.6-1.fc24
The HTTP extension aims to provide a convenient and powerful set of functionality for major applications. The HTTP extension eases handling of HTTP URLs, dates, redirects, headers and messages in a HTTP context both incoming and outgoing. It also provid es means for client negotiation of preferre...
[SECURITY] Fedora 23 Update: php-pecl-http-2.5.6-1.fc23
The HTTP extension aims to provide a convenient and powerful set of functionality for major applications. The HTTP extension eases handling of HTTP URLs, dates, redirects, headers and messages in a HTTP context both incoming and outgoing. It also provid es means for client negotiation of preferre...
rlt.ru XSS vulnerability
Vulnerable URL: http://rlt.ru/search/?searchquery=' autofocus onfocus='alert/XSSPOSED/ Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 21:01 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2504163 Google...
Xoops 2.5.7.2 - Cross-Site Request Forgery (Arbitrary User Deletions)
Exploit for php platform in category web applications var c=-1 var amttodelete=100 var id=document.getElementById"ids" var frm=document.getElementById"CSRF" function doit c++ arguments1.valu...
Citrix ICA Virtual Channels Overview
This article provides details of the design, functionality, and usage of the Citrix ICA Virtual Channels and focuses on the Citrix XenApp Plug-ins/Receiverfor Windows Target Audience Application developers, Citrixserver administrators, and help desk personnel. What are ICA Virtual Channels? A lar...
Fedora 23 : xen-4.5.2-7.fc23 (2016-2c15b72b01)
PV superpage functionality missing sanity checks XSA-167, CVE-2016-1570 VMX: intercept issue with INVLPG on non-canonical address XSA-168, CVE-2016-1571 Qemu: pci: NULL pointer dereference issue CVE-2015-7549 qemu: DoS by infinite loop in ehciadvancestate CVE-2015-8558 qemu: Heap-based buffer...
FreeBSD : xen-kernel -- PV superpage functionality missing sanity checks (7ed7c36f-ddaf-11e5-b2bd-002590263bf5)
The Xen Project reports : The PV superpage functionality lacks certain validity checks on data being passed to the hypervisor by guests. This is the case for the page identifier MFN passed to MMUEXTMARKSUPER and MMUEXTUNMARKSUPER sub-ops of the HYPERVISORmmuextop hypercall as well as for various...
How Often Should You Scan Websites and Web Applications for Vulnerabilities?
Web Applications and Websites Exist in a Dynamic Environment There is no questioning the fact that the web application security landscape is in a constant state of flux. The pace of change is not only rapid but resembles a constant game of cat and mouse between hackers and security professionals...
staedtler.com.hk XSS vulnerability
Vulnerable URL: http://www.staedtler.com.hk/en/search/?txsolrq= Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 20:43 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2659768 Google Pagerank| 5 VIP website...
forterra.co.uk XSS vulnerability
Open Bug Bounty ID: OBB-135383 Description| Value ---|--- Affected Website:| forterra.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
my-shop.ru XSS vulnerability
Vulnerable URL: http://my-shop.ru/shop/search/a/sort/z/page/1.html?f1439=0&f14;16=6&f14;6=book=0=1=4=25catid="...
gfmag.com XSS vulnerability
Vulnerable URL: https://www.gfmag.com/search/?contentsource=global-finance-magazine=1'%22%26%25promptString.fromCharCode88,83,83,80,79,83,69,68...
WordPress User Meta Manager 3.4.6 Plugin - Information Disclosure
Exploit for php platform in category web applications Exploit Title: WordPress User Meta Manager Plugin Information Disclosure Discovery Date: 2015-12-28 Public Disclosure Date: 2016-02-01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage:...
FreeBSD : shotwell -- not verifying certificates (448047e9-030e-4ce4-910b-f21a3ad5d9a0)
Michael Catanzaro reports : Shotwell has a serious security issue 'Shotwell does not verify TLS certificates'. Upstream is no longer active and I do not expect any further upstream releases unless someone from the community steps up to maintain it. What is the impact of the issue? If you ever use...
[SECURITY] Fedora 23 Update: prosody-0.9.10-1.fc23
Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...
How to Unlock (and Play) Hidden Chess Game Inside Facebook Messenger
What can you do with Facebook Messenger? Chat with your friends Send GIFs, stickers, and photos Make video calls Send people money in Messenger Have you ever wondered to Play a game while you chat with friends? Yes, it is possible. Facebook had made it to the reality by building a hidden built-in...