Serendipity Cross-Site Request Forgery Vulnerability

Serendipity is scalable PHP-powered weblog engine. A cross-site request forgery vulnerability in Serendipity 2.0.5 allows attackers to install any theme via a GET request...

CVE-2017-8101

There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request...

CVE-2017-8101

There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request...

Cross site request forgery (csrf)

There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request...

CVE-2017-8099

There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request...

CVE-2017-8101

There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request...

CVE-2017-8099

There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request...

Apache Ranger =< 0.5.2 allows to download policy definitions without authentication

Apache Ranger =:6080/service/plugins/policies/download/ The prerequisite to exploit this flaw is to know or guess the policy name. This finding may not constitute a vulnerability by itself, but is equivalent to having access to a network filtering policy: finding holes in policies is then easier...

Cloudera Manager Unauthenticated configuration download

Cloudera Manager allows to download module configurations without authentication by iterating on the module index integer starting from 1 through the following GET request: http://:7180/cmf/services//client-config This finding may not constitute a vulnerability by itself as: This behaviour can be...

CVE-2017-8099: Cross-Site Request Forgery (CSRF)

There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request...

PT-2017-18116

Name of the Vulnerable Software and Affected Versions Serendipity version 2.0.5 Description The issue allows attackers to perform a Cross-Site Request Forgery CSRF attack, enabling them to install any themes via a GET request. Recommendations For Serendipity version 2.0.5, consider restricting...

CVE-2016-3691: Cross-Site Request Forgery (CSRF)

Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method...

Cloudera Manager =< 5.5 Stored and reflected XSS (CVE-2016-4948)

Cloudera Manager =:7180/cmf/hardware/hosts/templates - In the following fields of the Kerberos activation page, which can then be triggered visiting the page http://:7180/cmf/clusters/1/kerberos/wizard KDC Server Host Kerberos Security Realm Kerberos Encryption Types Advanced Configuration Snippe...

CVE-2017-8101: Cross-Site Request Forgery (CSRF)

There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request...

Grab: Private Grab Messages on Android App can be accessed and cached by Search Engines

Description Hello. Today i discovered, that Search Engines can access the private users messages OTP pins, Group invites information etc. It happens because the https://grab-attention.grabtaxi.com host allows search indexing, and can leak the authtoken to the Search Engines which also can lead to...

CVE-2016-8723

An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Any HTTP GET request not preceded by an '/' will cause a segmentation fault in the web server. An attacker can send any of a multitude of potentially...

Null pointer dereference

An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Any HTTP GET request not preceded by an '/' will cause a segmentation fault in the web server. An attacker can send any of a multitude of potentially...

CVE-2017-7725

concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored...

CVE-2017-7725

concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored...

Design/Logic Flaw

concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored...