933 matches found
phpMyAdmin -- XSRF/CSRF vulnerability
The phpMyAdmin team reports: Description By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc. Severity We consider this vulnerability to be critical...
XSRF/CSRF vulnerability in phpMyAdmin
PMASA-2017-9 Announcement-ID: PMASA-2017-9 Date: 2017-12-20 Updated: 2018-01-03 Summary XSRF/CSRF vulnerability in phpMyAdmin Description By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc...
Microsoft Project Server Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Microsoft Project when Microsoft Project Server does not properly manage user sessions. For this Cross-site Request ForgeryCSRF/XSRF vulnerability to be exploited, the victim must be authenticated to logged on the target site. In a web-based attac...
CVE-2017-6328
CVE-2017-6328 affects Symantec Messaging Gateway before 10.6.3-267. The vulnerability is a cross-site request forgery (CSRF/XSRF) flaw where authenticated actions (e.g., logout) can be triggered by forged requests without multi-step tokens. Public sources (NVD, Nessus/SA plug-in, OpenVAS entry, E...
BigTree-CMS 4.2.x < 4.2.17 Multiple Vulnerabilities
Binary data 700143.prm...
Moodle 3.2.x < 3.2.3 Multiple Vulnerabilities
Binary data 700126.prm...
Moodle 3.0.x < 3.0.10 Multiple Vulnerabilities
Binary data 700124.prm...
IBM WebSphere Application Server 7.0 < 7.0.0.45 / 8.0 < 8.0.0.14 / 8.5 < 8.5.5.12 / 9.0 < 9.0.0.4 / Liberty 17.0 < 17.0.0.2 OAuth Service Provider XSRF
The version of IBM WebSphere Application Server running on the remote host is 7.0 prior to 7.0.0.45, 8.0 prior to 8.0.0.14, 8.5 prior to 8.5.5.12, 9.0 prior to 9.0.0.4, or Liberty 17.0 prior to 17.0.0.2. It is, therefore, affected by a cross-site request forgery XSRF vulnerability in the OAuth...
HP Operations Orchestration 10.x < 10.22.001 XSRF
Binary data 700088.prm...
Insecure Cookies
github.com/sensu/uchiwa doesn't use correctly secured cookies for sensitive information. The SecureFlag is currently not being set in the AuthenticationToken and the XSRF-Token cookies. This allows attackers to observe the cookies as they are sent in plaintext...
Moderate: Red Hat Security Advisory: cfme, cfme-appliance, and cfme-gemset security, bug fix, and enhancement update
An update for cfme, cfme-appliance, and cfme-gemset is now available for CloudForms Management Engine 5.7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
CVE-2017-2653
A number of unused delete routes are present in CloudForms which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protectfromforgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting o...
HP Version Control Repository Manager < 7.6.0 Multiple Vulnerabilities
According to its self-reported version, the HP Version Control Repository Manager VCRM application installed on the remote Windows host is prior to 7.6.0. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in OpenSSL in x509vfy.c due to improper...
WordPress < 4.7.1 Multiple Vulnerabilities
According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.7.1. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to...
Atlassian Bitbucket Server < 4.0.0 CSRF/XSRF
Binary data 9884.prm...
MyBB < 1.8.9 Multiple CSRF/XSRF
Binary data 9854.prm...
Fedora 24 : python-tornado (2016-a3618d9ef6)
Update to 4.4.2 Security fixes - A difference in cookie parsing between Tornado and web browsers especially when combined with Google Analytics could allow an attacker to set arbitrary cookies and bypass XSRF protection. The cookie parser has been rewritten to fix this attack...
MGASA-2016-0418 Updated python-tornado package fixes security vulnerability
A difference in cookie parsing between Tornado and web browsers especially when combined with Google Analytics could allow an attacker to set arbitrary cookies and bypass XSRF protection. The cookie parser has been rewritten to fix this attack...
Updated python-tornado package fixes security vulnerability
A difference in cookie parsing between Tornado and web browsers especially when combined with Google Analytics could allow an attacker to set arbitrary cookies and bypass XSRF protection. The cookie parser has been rewritten to fix this attack...