ME Monitoring Manager v9.x; v10.x - Multiple Vulnerabilities

Document Title: =============== ME Monitoring Manager v9.x; v10.x - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=115 http://www.cnnvd.org.cn/vulnerability/show/cvid/2012020039 ID: CNNVD-201202-039 Release Date: =============...

CVE-2011-4837

CVE-2011-4837 describes a Cross-site request forgery (CSRF) in the HomeSeer HS2 web interface (/ctrl) that allows an attacker to hijack admin authentication and perform actions, including executing arbitrary programs, on HS2 2.5.0.20. The available sources confirm the vulnerability and affected v...

(SWAT): Absent CSRF protection in various Samba web configuration formulars

Multiple cross-site request forgery CSRF vulnerabilities in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that 1 shut down daemons, 2 start daemons, 3 add shares, 4 remove shares, 5 add printers...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for...

PT-2011-2581 · Red Hat · Spacewalk +1

Name of the Vulnerable Software and Affected Versions: Red Hat Network RHN Satellite Server version 5.4 Description: A session fixation issue in Red Hat Network Satellite Server allows remote attackers to hijack web sessions. The issue is related to Spacewalk, but the specific vectors are not...

CVE-2010-4507

Multiple cross-site request forgery CSRF vulnerabilities on the iSpot 2.0.0.0 R1679, and the ClearSpot 2.0.0.0 R1512 and R1786, with firmware 1.9.9.4 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the cmd parameter in an...

CVE-2010-4106

HP Insight Control for Linux is affected by a Cross-Site Request Forgery (CSRF) vulnerability in versions prior to 6.2, which could allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. The issue, CVE-2010-4106, has a CVSSv2 base score of 6.8 (MEDIUM). HP...

CVE-2010-3288

Cross-site request forgery CSRF vulnerability in HP Systems Insight Manager SIM before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2009-4849

Multiple cross-site request forgery CSRF vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to hijack the authentication of administrators for requests that 1 create a new user account via a save action to tvserver/user/user.do, 2 shutdown a...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 allows remote attackers to hijack the authentication of unspecified victims via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."...

squirrelmail: CSRF issues in all forms

Multiple cross-site request forgery CSRF vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to 1 functions/mailboxdisplay.php, 2...

Session fixation

phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header...

CVE-2009-2964

CVE-2009-2964 : Multiple CSRF vulnerabilities in SquirrelMail 1.4.19 and earlier, and NasMail before 1.7, allow remote attackers to hijack user authentication via various forms (send message, change preferences, etc.). Affected components include numerous PHP scripts (functions/mailbox_display.ph...

CVE-2009-1757

Transmission is affected by a CSRF vulnerability (CVE-2009-1757) in the web interface, enabling an attacker to hijack user authentication via unknown vectors. Affected releases include Transmission 1.5 up to 1.53 and 1.6 up to 1.61. The issue has been documented across multiple advisories (Red Ha...

CVE-2009-0093

MS09-008 fixes multiple DNS/WINS vulnerabilities in Windows servers that could allow remote attackers to spoof WPAD/ISATAP and hijack network traffic. The WPAD vulnerability (CVE-2009-0093) arises when dynamic updates are enabled and WPAD/ISATAP registrations are not restricted in DNS, enabling a...

CVE-2008-0900

CVE-2008-0900 affects BEA WebLogic Server and Express versions 8.1 SP4–SP6, 9.2 MP1, and 10.0. The root cause is a session fixation vulnerability that allows remote authenticated users to hijack web sessions via unknown vectors. Affected components are web session handling functions in these BEA ...