Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Revive Adserver before 3.2.2 allow remote attackers to hijack the authentication of users for requests that 1 perform certain plugin actions and possibly cause a denial of service disabled core plugins via unknown vectors or 2 change the...

CVE-2015-7366

Multiple cross-site request forgery CSRF vulnerabilities in Revive Adserver before 3.2.2 allow remote attackers to hijack the authentication of users for requests that 1 perform certain plugin actions and possibly cause a denial of service disabled core plugins via unknown vectors or 2 change the...

F5 Big-IP 10.2.4 Build 595.0 Hotfix HF3 - File Path Traversal Vulnerability

Exploit for hardware platform in category web applications Exploit Title: F5 BigIP File Path Traversal Vulnerability Discovered by: Karn Ganeshen Reported on: April 27, 2015 New version released on: September 01, 2015 Vendor Homepage: www.f5.com Version Reported: F5 BIG-IP 10.2.4 Build 595.0 Hotf...

Liferay 6.1.0 CE - Privilege Escalation

Exploit Title: Liferay 6.1.0 CE GA1 Privilege Escalation Date: 18/05/2015 Exploit Author: Massimo De Luca - mentat.is Vendor Homepage: https://www.liferay.com Software Link: http://www.liferay.com/it/community/releases/-/assetpublisher/nSr2/content/id/18060360 Version: 6.1.0 CE Tested on: -...

kppw最新版2处sql注入。

简要描述： 二次注入。 详细说明： 1 /www/control/user/accountbasic.php ..... $arrMemberExts = kekezu::gettabledata "", "witkeymemberext", " type='sect' and uid= ".$gUid, "", "", "", "k" ; ........ if $sect foreach $sect as $k = $v if $arrMemberExts $k dbfactory::execute sprintf " update %switkeymemberext set...

Shopify: change Login Services settings without owner access

Hi in settings - account owner can set login service for staff members! this is only available for owners, and full access admins can't see or change this values! admin with setting access can send a "POST" request to shop.json and change this settings! steps: - get access token for one full acce...

Sql injection

SQL injection vulnerability in the web interface in Cisco Unity Connection 9.11.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824...

Cisco Unity Connection Web Interface SQL Injection Vulnerability

A vulnerability in the web interface of Cisco Unity Connection UC could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An attacker...

Bedita 3.5.1 - Cross-Site Scripting

Bedita 3.5.1 - Cross-Site Scripting Title: Bedita 3.5.1 XSS vulnerabilites Application: Bedita Version: 3.5.1 Software Link: http://www.bedita.com/ Date: 2015-03-09 Author: Sébastien Morin Contact: https://twitter.com/SebMorin1 Category: Web Applications =================== Introduction:...

迪普UMC统一管理系统SQL注入

DPtech UMC统一管理中心案例：http://222.171.148.161/UMC/Login.action http://222.75.152.197:8080/UMC/Login.action http://222.47.70.3:8080/UMC/Login.action http://218.28.177.149/UMC/Login.action http://211.138.102.195:8080/UMC/Login.action针对部分型号，并不通杀。POST /UMC/Login.action HTTP/1.1 Host: 222.171.148.161...

up.time 7.5.0 Superadmin Privilege Escalation

up.time 7.5.0 Superadmin Privilege Escalation Exploit Vendor: Idera Inc. Product web page: http://www.uptimesoftware.com Affected version: 7.5.0 build 16 and 7.4.0 build 13 Summary: The next-generation of IT monitoring software. Desc: up.time suffers from a privilege escalation issue. Normal user...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cisco Finesse 10.51 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a 1 GET or 2 POST request, aka Bug IDs CSCuq82322, CSCut95853, and CSCuq73975...

CVE-2015-4302

The web interface in Cisco FireSIGHT Management Center 5.3.1.4 allows remote attackers to delete arbitrary system policies via modified parameters in a POST request, aka Bug ID CSCuu25390...

CVE-2015-4483

Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request...

Cross site request forgery (csrf)

Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request...

CVE-2015-4483

Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request...

CVE-2015-4483

CVE-2015-4483 affects Mozilla Firefox up to version 40.0. A vulnerability in the feed: protocol combined with POST requests can bypass the browser’s mixed-content protections, enabling MITM-scripted content on a page. Remediation: upgrade to the latest Firefox (40.0+).

Google Adsense & Hotel Booking <= 1.0.5 - Open Proxy

Plugin is still affected and has been closed. The code in ./plugin/google-adsense-and-hotel-booking/proxy.php allows an arbitrary user to proxy POST requests though the host site. This may allow attackers to hide attacks, or DoS a site if the POST request is pointed back at itself causing a loop...

浪潮某政府系统通用SQL注入24处打包

简要描述： ... 详细说明： 某政府系统通用SQL注入24处打包。 案例：（23处GET注入+1处POST注入） 23处GET注入： http://www.whaac.gov.cn:8080/BusinessRegistration/BRProjectList.aspx?page=1&procode= http://www.cfdonline.org.cn/OutPortalCFD//BusinessRegistration/BRProjectList.aspx?page=1&procode=...

phpFileManager 0.9.8 Cross Site Request Forgery

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPFILEMANAGER0729.txt Vendor: ================================ phpfm.sourceforge.net Product: ============================ phpFileManager version 0.9.8 Vulnerability Type:...