eXtplorer Cross-Site Request Forgery Vulnerability (CNVD-2015-06704)

eXtplorer is a PHP-based online file management program. A cross-site request forgery vulnerability exists in eXtplorer. It allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious actions in the context of the target user...

McAfee Vulnerability Manager 'Organizations' Cross-Site Request Forgery Vulnerability

McAfee Vulnerability Manager is a vulnerability management application. A cross-site request forgery vulnerability exists on the McAfee Vulnerability Manager 'Organizations' page, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user context...

IBM WebSphere eXtreme Scale Cross-Site Request Forgery Vulnerability

IBM WebSphere eXtreme Scale is a distributed caching solution. A cross-site request forgery vulnerability exists in IBM WebSphere Extreme Scale, which allows remote attackers to construct malicious URIs, trick users into parsing them, and perform malicious actions in the context of the target use...

Apple iOS HSTS Bypass Sensitive Data Leakage Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. Apple iOS suffers from a security vulnerability that allows remote attackers to construct malicious URLs that trick users into loading them and bypassing HSTS to obtain sensitive data...

Drupal Ajax System Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Ajax System, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies,...

Cisco TelePresence MSE 8000 Device Cross-Site Request Forgery Vulnerability

The Cisco TelePresence MSE 8000 devices are a suite of high-capacity voice and video conferencing media services engine appliances. A cross-site request forgery vulnerability exists in the Cisco TelePresence MSE 8000 devices, which allows remote attackers to construct malicious URIs, trick users...

Drupal Spider Contacts Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open-source content management system developed in PHP.Spider Contacts is a contact component. A cross-site request forgery vulnerability exists in the Drupal Spider Contacts module that allows remote attackers to construct malicious URIs, trick users into parsing them, and can...

Ektron Cross-Site Request Forgery Vulnerability

Ektron is an enterprise-level Web content management system. A cross-site request forgery vulnerability exists in Ektron that allows remote attackers to construct malicious URIs and trick users into parsing them, which can perform malicious actions in the context of the target user...

Shopify: Force 500 Internal Server Error on any shop (for one user)

There is very strange behavior. If user open urls like below: - https://whashp.myshopify.com/?previewthemeid=11288717 - or https://lmfshp.myshopify.com/?previewthemeid=11290937 He got redirect to shop https://whashp.myshopify.com/ and 500 Internal Server Error response, and reload does not help i...

ASUS RT-G32 Cross-Site Request Forgery Vulnerability

ASUS RT-G32 routers is a router device. A cross-site request forgery vulnerability exists in ASUS RT-G32 routers, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious actions in the context of the target user...

724CMS Has Multiple Cross-Site Scripting Vulnerabilities

724CMS is a content management system. Multiple cross-site scripting vulnerabilities exist in 724CMS due to the program failing to properly filter user-submitted input. A remote attacker can exploit the vulnerabilities to construct malicious URIs and trick users into parsing them, which can be us...

Drupal Term Queue Module Cross-Site Scripting Vulnerability

Drupal is an open source content management platform. A cross-site scripting vulnerability exists in the Drupal Term Queue module, which allows remote attackers to exploit this vulnerability to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive...

Fat Free CRM Cross-Site Request Forgery Vulnerability

Fat Free CRM is a customer application management. Fat Free CRM suffers from a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform malicious actions...

Cosmoshop 'index.cgi' Cross-Site Scripting Vulnerability

Cosmoshop is an online store application. A cross-site scripting vulnerability exists in Cosmoshop 'index.cgi', which can be exploited by remote attackers to construct malicious URIs that can be tricked into being parsed by the user, which can be used to obtain sensitive cookies, hijack sessions,...

Facebook Opens ThreatExchange Information Sharing Platform

Facebook, with its giant infrastructure and its equally wide view into Internet attacks, has built an information-sharing platform that it hopes will entice other big technology companies to join and contribute threat data and indicators of compromise. The platform, called ThreatExchange, already...

Unspecified Cross-Site Scripting Vulnerability in PerlTreeBBS

PerlTreeBBS is a BBS application. PerlTreeBBS suffers from an unspecified cross-site scripting vulnerability that can be exploited by remote attackers to construct malicious URIs, trick users into parsing them, obtain sensitive cookies, hijack sessions, or perform malicious operations on the clie...

Tapatalk for WoltLab Burning Board 'welcome.php' Has Multiple Cross-Site Scripting Vulnerabilities

WoltLab Burning Board is a forum program and Tapatalk is a plug-in application. Tapatalk for WoltLab Burning Board 'welcome.php' has a cross-site scripting vulnerability that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to...

Microsoft Expands MAPP Program to Incident Response Teams

Microsoft is expanding its MAPP program that shares attack and protection information with other security vendors and will now be sharing some data with incident responders, as well. The new system will enable organizations such as CERTs and internal IR teams to exchange information on specific...

phishing_vector

This plugins finds phishing vectors in web applications, for example, a bug of this type is found if I request the URL "http://site.tld/asd.asp?info=http://attacker.tld" and in the response HTML the web application sends: … iframe src="http://attacker.tld" …. Plugin type Audit Options This plugin...

Blackhole Exploit Kit's Dominance On Infected Hosts Could Push Rivals To the Cloud

The Blackhole exploit kit has a near monopoly on infected Web pages, according to Web security firm M86’s latest Security Labs Report, issued today. PDF The bi-annual report, which covers the last half of 2011, July to December, describe Blackhole as the source of a whopping 95 percent of all the...