Apache NiFi 安全漏洞

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. A security vulnerability exists in Apache NiFi that stems from the fact that when creating or updating credentials...

Flickr: CSRF in Account Deletion feature (https://www.flickr.com/account/delete)

CSRF was missing in Account Deletion form due to switching login providers. @asad0x01 found the vulnerability and reported it concisely, even with a video POC. The issue was fixed with 60 days, but we were slow to resolve the ticket and disclose. Sometimes you just get lucky. When Flickr was owne...

Cross site scripting

The Janrain Engage formerly RPX module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting XSS attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login...