Alcatel-Lucent OmniSwitch Web Interface Cross Site Request Forgery Vulnerability

Vulnerability in the management web interface of an Alcatel-Lucent OmniSwitch 6450. The management web interface has no protection against cross-site request forgery attacks. This allows specially crafted web pages to change the switch configuration and create users, if an administrator accesses...

TickFa 1.x SQL Injection

/ + Author: Mohammad Reza Espargham + Title: TickFa 1.x - SQL Injection Vulnerability + Date: 26-04-2015 + Vendor: http://tickfa.aftab.cc/ + SoftWare Link : http://tickfa.aftab.cc/dl/tickfa.zip + Type: WebAPP + Tested on: KaliLinux Debian / curl 7.35.0 + GHDB : intext:"تیکت برای بخش مورد نظر ایجا...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cisco Headend Digital Broadband Delivery System allows remote attackers to hijack the authentication of arbitrary users...

CVE-2015-0218

Cross-site request forgery CSRF vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout...

PT-2015-4855 · Cisco · Cisco Unified Intelligence Center

Name of the Vulnerable Software and Affected Versions: Cisco Unified Intelligence Center version 10.61 Description: A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users. Recommendations: For Cisco Unified Intelligence Center version 10.61...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cisco MediaSense 10.51 and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu16728...

[SECURITY] Fedora 21 Update: mingw-curl-7.42.0-1.fc21

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

Legend Perl IRC Bot - Remote Code Execution

legendrce.py Legend Perl IRC Bot Remote Code Execution PoC author: Jay Turla @shipcod3 description: This is a RCE PoC for Legend Bot which has been used in the Shellshock spam October 2014. reference:...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in API features in Cisco Unified MeetingPlace 8.61.9 allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus95884...

CVE-2015-0704

CVE-2015-0704 affects Cisco Unified MeetingPlace Server (8.6(1.9)) with CSRF vulnerabilities in API features that allow remote attackers to hijack user authentication. The root cause is insufficient CSRF protections in multiple-state-changing URL API functionalities. Impact, as documented, is use...

CVE-2015-3370

Cross-site request forgery CSRF vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the authentication of users with the "nodeinvitecanmanageinvite" permission for requests that re-enable node invitations via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the authentication of users with the "nodeinvitecanmanageinvite" permission for requests that re-enable node invitations via unspecified vectors...

IBM WebSphere Portal Unspecified Reflected XSS (PI30620)

The version of IBM WebSphere Portal installed on the remote host is affected by an unspecified cross-site scripting vulnerability due to improper validation of user-supplied input. A remote attacker can exploit this flaw using a specially crafted URL to execute arbitrary script code in a user's w...

Windows exposure“redirect SMB”vulnerability, the impact of Win10, including all versions-bug warning-the black bar safety net

Recently Cylance company released a Windows System to serious vulnerability, the attacker via the exploit can steal user authentication information. The vulnerability includes the latest Windows 1 0 preview version, including all versions of Windows, as well as Adobe, Apple, Box, Oracle, Symantec...

User authentication bypass

More info at https://thelia.net/version-2-1-3-with-security-fix...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users...

CVE-2015-0905

CVE-2015-0905 affects the bBlog platform. The vulnerability is a cross-site request forgery (CSRF) that allows an attacker to hijack the authentication of arbitrary users. If a logged-in user visits a malicious page, unintended operations may be performed on behalf of that user. Affected details ...

CVE-2015-0259

OpenStack Compute Nova before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage...

CVE-2015-2759

Multiple cross-site request forgery CSRF vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint DLPe before 9.3 Patch 4 Hotfix 16 9.3.416.4 allow remote attackers to hijack the authentication of users for requests that 1 obtain sensitive information or 2 modify the database...

CVE-2015-2759

Multiple cross-site request forgery CSRF vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint DLPe before 9.3 Patch 4 Hotfix 16 9.3.416.4 allow remote attackers to hijack the authentication of users for requests that 1 obtain sensitive information or 2 modify the database...