CVE-2015-5906

The CVE-2015-5906 issue affects WebKit in Apple iOS up to version 9, where the password input context handling allowed QuickType to infer the last character of a password. This is a WebKit input-context vulnerability that could aid password disclosure. The concrete detail is that the vulnerabilit...

PT-2015-2128

Name of the Vulnerable Software and Affected Versions iOS versions prior to 9 Description The issue is related to the HTML form implementation in WebKit, which does not properly protect sensitive data. This might allow remote attackers to discover a password by leveraging a later prediction...

Cross site request forgery vulnerability in Linksys WAG120N

Hello all, i want to share a problem that i found with Linksys router WAG120N. It could be possible to modify router's configuration when a user visit a webpage with an specific form it is a similar problem that i sent some days ago with Comtrend routers:...

Syria2u Arbahtube 1.0 Cross Site Request Forgery / Cross Site Scripting

| Title : Syria2u Arbahtube v1.0 Mullti Vulnerability | Author : indoushka | email : [email protected] | Dork : Copyright ©2014 script syria2u version1. All Rights Reserved. | Tested on: win8.1 Fr V.Pro 15:39 22/05/2015 | Bug : Mullti | Download : http://www.syria2u.com/...

Syria2u You Shop 1.0 Cross Site Request Forgery / Cross Site Scripting

| Title : Syria2u You Shop v1.0 Mullti Vulnerability | Author : indoushka | email : [email protected] | Dork : سكربت يوشــوب للتسوق عبر الانترنت , قم باختيار المدينة ثم تمتع بالتسوق في مدينتك من أي مكان | Tested on: win8.1 Fr V.Pro 15:39 23/05/2015 | Bug : Mullti | Download :...

Simple Invoice 2011.1 Cross Site Request Forgery

Affected software: simple invoice Type of vulnerability:adding admin user via csrf URL:simpleinvoices.org Discovered by: provensec Website: provensec.com version:2011.1 Proof of concept...

Netgear WNR2000v4 Abuse / XSS / Command Injection Vulnerabilities

Netgear WNR2000v4 suffers from code execution, missing abuse control, and cross site scripting vulnerabilities. I'm releasing a few vulnerabilities for the WNR2000v4 Netgear router. Netgear is currently working these issues. Quick Fix --------- If you own a WNR2000v4, set a strong password and se...

Subrion 3.3.0 Cross Site Request Forgery

Affected software: subrion Type of vulnerability: csrf to sql injection URL: http://demo.subrion.org Discovered by: Provensec Website: http://www.provensec.com version v3.3.0 Proof of concept no csrf protection on database form which made subrion to vulnerable to database injection vuln parameter...

Feng Office 1.7.4 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/47049/info alert0" / alert0" /...

Square: CSRF on adding clients

Authenticate to an account. 2. Trick the victim to submit the following HTML: input type="hidden"...

X (Formerly Twitter): HTML form without CSRF protection at http://try.crashlytics.com/enterprise/

Vulnerability description:- This alert may be a false positive, manual confirmation is required. Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitte...

Site2Nite Big Truck Broker "txtSiteId" SQL Injection Vulnerability

No description provided by source. !-- Site2Nite Big Truck Broker txtSiteId SQL Injection Vulnerability PRODUCT: Site2Nite Big Truck Broker PRODUCT URL: http://www.site2nite.com/productdetail.asp?id=14 RESEARCHERS: underground-stockholm.com RESEARCHERS URL: http://underground-stockholm.com/ -- ht...

Apple Safari Web Browser 1.x HTML Form Status Bar Misrepresentation Vulnerability

source: http://www.securityfocus.com/bid/11949/info A vulnerability has been identified in Apple Safari Web Browser that allows an attacker to misrepresent the status bar in the browser, allowing vulnerable users to be mislead into following a link to a malicious site. The issue presents itself...

D-Link VoIP Phone Adapter - XSS/CSRF Remote Firmware Overwrite

No description provided by source. D-link VoIP Phone Adapter XSS and XSRFremote firmware overwrite model number: DVG-2001s f/w version 1.00.007 Better than just remote code execution, you control the firmware. html form action=http://10.1.1.166/Forms/cbiSetSWUpdate?16640,0,0,0,0,0,0,0,0 method=PO...

Beetel 450TC2 Router Admin Password CSRF Vulnerability

No description provided by source. ??!-- Exploit Title: Beetel 450TC2 Router Admin Password Cross Site Request Forgery Vulnerability Date: 30/04/2014 Exploit Author: shyamkumar somana Vendor Homepage: www.beetel.in Version: 450TC2 - Firmware version : TX6-0Q-005retail Tested on: Windows 8 Beetel...

Microsoft Internet Explorer 5.0 HTML Form Control DoS

No description provided by source. Microsoft Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4 HTML Form Control DoS source: http://www.securityfocus.com/bid/606/info Certain Microsoft applications IE5, Outlook Express 5 are unable to display large HTML form fields within HTML tables...

Maxwebportal <= 1.36 password.asp Change Password Exploit (1 - html)

No description provided by source. !-- Hi, I'm Soroush Dalili from Grayhatz Security Group GSG . I found dangerous sql injection in Maxwebportal version 1.35,1.36,2.0, 20050418 Next Remote user can inject his/her code in memKey var. and change other users password in password.asp Exploit codes to...

List Site Pro 2.0 User Database Delimiter Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6685/info List Site PRO is a top site ranking system that counts hits from member sites and then ranks them according to the number of hits. A problem has been reported for List Site PRO that would allow an attacker to...

Opera Web Browser 8.0/8.5 HTML Form Status Bar Misrepresentation Vulnerability

source: http://www.securityfocus.com/bid/15472/info A vulnerability has been identified in Opera Web browser that allows an attacker to misrepresent the status bar in the browser, allowing vulnerable users to be mislead into following a link to a malicious site. This vulnerability would most...

SPI Dynamics WebInspect 5.0.196 Cross Application Script Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14385/info WebInspect is vulnerable to a cross-application script injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied data prior to including it in content rendere...