CVE-2010-0660

Google Chrome before 4.0.249.78 sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging...

Limny v2.0 Change Email and Password CSRF Exploit

Exploit for unknown platform in category web applications ================================================= Limny v2.0 Change Email and Password CSRF Exploit ================================================= /????????????????????????????\ :Limny 2.0 Change Pass CSRF : / /Discovered By: \ |Luis...

Limny v2.0 Create Admin User CSRF Exploit

Exploit for unknown platform in category web applications ========================================= Limny v2.0 Create Admin User CSRF Exploit ========================================= /????????????????????????????\ :Limny 2.0 CSRF : / /Discovered By: \ |Luis Santana | / Overview ?????????? The...

Limny 2.0 - Cross-Site Request Forgery (Create Admin User)

Limny 2.0 - Cross-Site Request Forgery Create Admin User /¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯\ :Limny 2.0 CSRF : / /Discovered By: \ |Luis Santana | / Overview ¯¯¯¯¯¯¯¯¯¯ The Limny 2.0 CMS is vulnerable to a Cross-Site-Request Forgery exploit which allows for a malicious attacker to create their own...

Limny 2.0 - Cross-Site Request Forgery (Change Email and Password)

/¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯\ :Limny 2.0 Change Pass CSRF : / /Discovered By: \ |Luis Santana | / Overview ¯¯¯¯¯¯¯¯¯¯ The Limny 2.0 CMS is vulnerable to a Cross-Site-Request Forgery exploit which allows for a malicious attacker to change the password, and email address, of any user, including...

Seven jubilee dance music management system v3. 0 0day analysis-vulnerability warning-the black bar safety net

!-- Include File="CmsDj. Conn. asp" - !-- Include File="CmsDj. Function. asp" - % Fromurl = CstrRequest. ServerVariables"HTTPREFERER" Servurl = CstrRequest. ServerVariables"SERVERNAME" If midFromurl,8,lenServurl Servurl Then //determine the REFERER Response. Write "does not support external links...

Cross site scripting

Cross-site scripting XSS vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header in a news.1 aka news to email action...

CVE-2009-3444

Cross-site scripting XSS vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header in a news.1 aka news to email action...

CVE-2009-3444

The CVE-2009-3444 entry concerns the e107 web platform (versions 0.7.16 and earlier) with a Cross-Site Scripting (XSS) vulnerability in email.php triggered via the HTTP Referer header in the news.1 (news to email) action. Affected component: e107 (email.php within news-to-email flow). Root cause:...

CVE-2009-3444: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header in a news.1 aka news to email action...

Cross site request forgery (csrf)

PHPKIT 1.6.4 PL1 includes the session ID in the URL, which allows remote attackers to conduct cross-site request forgery CSRF attacks by reading the PHPKITSID parameter from the HTTP Referer and using it in a request to 1 modify the user profile via uploadfiles/include.php or 2 create a new...

CVE-2008-7193

PHPKIT 1.6.4 PL1 includes the session ID in the URL, which allows remote attackers to conduct cross-site request forgery CSRF attacks by reading the PHPKITSID parameter from the HTTP Referer and using it in a request to 1 modify the user profile via uploadfiles/include.php or 2 create a new...

CVE-2008-7193: Cross-Site Request Forgery (CSRF)

PHPKIT 1.6.4 PL1 includes the session ID in the URL, which allows remote attackers to conduct cross-site request forgery CSRF attacks by reading the PHPKITSID parameter from the HTTP Referer and using it in a request to 1 modify the user profile via uploadfiles/include.php or 2 create a new...

CVE-2008-7082: Cross-Site Request Forgery (CSRF)

MyBB aka MyBulletinBoard 1.4.3 includes the sensitive mypostkey parameter in URLs to moderation.php with the 1 mergeposts, 2 split, and 3 deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery CSRF protection mechanism to hijack the...

CVE-2008-6983

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gvfolderdata parameter, as demonstrated by modifying modules/tool/url2header.php...

Code injection

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gvfolderdata parameter, as demonstrated by modifying modules/tool/url2header.php...

CVE-2008-6983

CVE-2008-6983 affects devalcms 1.4a: the file modules/tool/hitcounter.php allows remote code execution via the HTTP Referer header using the gv_folder_data parameter, demonstrated by modifying modules/tool/url2header.php. This indicates improper handling of user-controlled input in the vulnerable...

CVE-2008-6983

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gvfolderdata parameter, as demonstrated by modifying modules/tool/url2header.php...

CVE-2008-6983: Improper Control of Generation of Code

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gvfolderdata parameter, as demonstrated by modifying modules/tool/url2header.php...

FreeBSD : drupal -- multiple vulnerabilities (be927298-6f97-11de-b444-001372fd0af2)

The Drupal Security Team reports : Cross-site scripting The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages...