69 matches found
Cross site request forgery (csrf)
The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive...
CVE-2015-3752
The CVE-2015-3752 issue affects WebKit’s Content Security Policy handling in Safari (and underlying WebKit in iOS) prior to specific updates. The root cause is improper restriction of cookie transmission for CSP report requests, enabling potential leakage of cookies via cross-origin requests or p...
CVE-2015-3752
The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive...
CVE-2015-3752
The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive...
CSRF Vulnerability in jquery-rails
In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to " https://attacker.com" note the leading space that will be passed to JQuery, who will s...
Adobe CVE-2011-2461 Remains Exploitable Via Flex Four Years After Patch
UPDATE: This article has been updated to add commentary and clarification from Adobe. A four year old Adobe Flash patch did not properly resolve a vulnerable Flex application, and attackers can exploit the bug, which is said to affect some 30 percent of Alexa’s top 10 most popular sites in the...
cmseasy csrf通过一个xss最后getshell
简要描述： 为什么我们要选择get类型的呢，因为get类型存储到数据库的时候触发时候管理员是察觉不到的，可以通过图片等进行操作，然后我们存储一个xss后门，这样一来，我们就可以加载一个远端的js，那么就各种无视token和referer了 详细说明： 开始我们先分析一段源代码： celive/admin/system.php:line:128-142: if$do == 'add' and $username != '' $password = addslashes$REQUEST'password'; $password = md5$password; $realname =...
