PHP Scripts Mall Readymade Video Sharing Script Cross-Site Request Forgery Vulnerability

PHP Scripts Mall Readymade Video Sharing Script is a set of PHP based online video sharing website scripts by PHP Scripts Mall India. A cross-site request forgery vulnerability exists in PHP Scripts Mall Readymade Video Sharing Script. A remote attacker can use the user-profile-edit.php file to...

Guidance on configuring WEM settings per user/user groups

How to set up WEM configuration specifically for user/user groups...

XenMobile BitLocker Policy for Windows 10 Desktop/Tablet

XenMobile BitLocker Policy for Windows 10 Desktop/Tablets BitLocker is a disk encryption feature that is built into Windows 10. It can be controlled via MDM policy beginning in Windows 10 1703 build. The policy CSP is available...

CVE-2017-1000008

Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify account information, including their password...

CVE-2017-1000008

Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify account information, including their password...

Cross site request forgery (csrf)

Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify account information, including their password...

Cross-site Request Forgery (CSRF)

phpMyFAQ is vulnerable to cross-site request forgery CSRF. The library does not properly escape certain strings, allowing a malicious website to change a user's settings...

CVE-2017-1000008

Summary: CVE-2017-1000008 affects Chyrp Lite 2016.04. A CSRF flaw in the user settings function lets an attacker hijack the logged-in user’s session to modify account information, including passwords. The CVSS metrics in the primary entry indicate a high impact (C/H, I/H, A/H) with network access...

How to Configure Citrix Profile Management

The primary intent of this article is to provide steps on how to configure Citrix Profile management for the first timeassuming that Virtual Apps and Desktops/Citrix Cloud environment is already configured. Introduction Profile management ensures that the user’s personal settings are applied to t...

e107 CMS is less than or equal to 2. 1. 2 elevation of privilege vulnerability analysis-vulnerability warning-the black bar safety net

0x00 vulnerability background e107 CMS is a based on PHP, Bootstrap, Mysql, web site content management system, can be widely used for personal blogs, enterprise built station, in the global range more widely. 0x01 vulnerability affects version version 0x02 vulnerability analysis of the environme...

e107 CMS 2.1.2 - Privilege Escalation

e107 CMS 2.1.2 - Privilege Escalation Exploit Title: e107 CMS 2.1.2 Privilege Escalation Date: 09-11-2016 Software Link: http://e107.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Datas from...

CVE-2016-7442

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the proxy user settings in "system settings / scan settings / anti spam" configuration tab...

CVE-2016-7397

The CVE-2016-7397 vulnerability affects the Sophos UTM Frontend component (firmware 9.405-5 and earlier). A local administrator can disclose sensitive password information by reading the value field of the SMTP user settings in the Notifications configuration tab. Public disclosures and multiple ...

CVE-2016-7397

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the SMTP user settings in the notifications configuration tab...

ISPConfig 3.0.5 Cross Site Request Forgery

!-- tanks: Dr Ms Jk - n1arash - Milad Hacking - malahsky...

Clicky by Yoast <= 1.5 - Minor Security Improvements

From the changelog: - Only allow expected characters in user settings thanks to a report by Netsparker. - Proper escaping of translated string in image attributes...

MGASA-2015-0463 Updated python-django packages fix security vulnerability

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format CVE-2015-8213...

CVE-2015-5640

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

Cross site request forgery (csrf)

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

CVE-2015-5640

CVE-2015-5640 relates to baserCMS prior to 3.0.8. Multiple connected sources confirm a vulnerability where a logged-in, authenticated user can modify arbitrary user settings by sending a specially crafted request, effectively an access-control bypass. The impact described across advisories is tha...