947 matches found
XSRF/CSRF due to DOM based XSS in the micro history feature
PMASA-2014-10 Announcement-ID: PMASA-2014-10 Date: 2014-09-13 Summary XSRF/CSRF due to DOM based XSS in the micro history feature Description By deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a...
Halon Security Router < 3.2r2 Multiple Vulnerabilities
According to its self-reported version, the instance of Halon Security Router running on the remote host is affected by multiple vulnerabilities : - Multiple reflected cross-site scripting vulnerabilities exist in the web interface due to a failure to sanitize user-supplied input. - Multiple...
Flickr Cross-Site Request Forgery Vulnerability Patched
Yahoo-owned Flickr, one of the biggest online photo management and sharing website in the world was recently impacted by a web application vulnerability, which could allow an attacker to modify users’ profile image. Flickr is one of the most popular photo sharing website with more than 87 million...
SkaDate Lite 2.0 Multiple XSRF And Persistent XSS Vulnerabilities
Summary SkaDate Lite is a new platform that makes it easy to start online dating business in just a few easy steps. No programming or design knowledge is required. Install the solution, pick a template, and start driving traffic to your new online dating site. Description SkaDate Lite version 2.0...
SkaDate Lite 2.0 - Multiple Cross-Site Request Forgery / Persistent Cross-Site Scripting Vulnerabilities
SkaDate Lite 2.0 Multiple XSRF And Persistent XSS V...
UserPreferencesResource accepts form encoded data, is vulnerable to XSRF attacks
UserPreferencesResource exposes all data stored in a UserPreferences object, and allows updating it via a POST. This vulnerability needs to be closed before the next deployment...
UserPreferencesResource accepts form encoded data, is vulnerable to XSRF attacks
UserPreferencesResource exposes all data stored in a UserPreferences object, and allows updating it via a POST. This vulnerability needs to be closed before the next deployment...
Allomani Movies Library 2.0 - CSRF Vulnerability (Add Admin)
No description provided by source. Movies Library 2.0 XSRF Vulnerability Add Admin ==================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://allomani.com/en/moviesscript.html === Exploit === form method=POST name=form0...
eazyPortal 1.0.0 - Multiple Vulnerabilities
No description provided by source. ----------------------------------------------------------------------------------------------- Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 02. January 2010...
openauto 1.6.3 - Multiple Vulnerabilities
No description provided by source. Credit:Michael Brooks Affects:OpenAuto 1.6.3 Vulnerabilites: XSRF/XSS/Blind SQLi/Captcha Bypass http://openautoclassifieds.com/ ---------------------------------------------------------------------------------------------------- Reflective XSS by adding a onclic...
interphoto gallery - Multiple Vulnerabilities
No description provided by source. ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | Day 6 0day | | | | || / \ || | | | || ||// \/|/ ''' - Title : InterPhoto Gallery Multiple Remote Vulnerabilities - Affected Version : = 2.4.0 - Vendor Site :...
New-CMS - Multiple Vulnerability
No description provided by source. Multiple Vulnerability in New-CMS Vendor SW: New-CMS Version: 1.08 but possible all versions Vendor URL: www.new-cms.org Tested on: Ubuntu Server 9.10 Category: Webapps/0day Date: 17 Feb 2010 Author: Alberto fulgur Fontanella Author URL: ictsec.wordpress.com...
DirectAdmin 1.34.0 - CSRF Create Administrator Vulnerability
No description provided by source. Vendor: http://www.directadmin.com/ Code : Create Administrator : html titleDirectAdmin v1.34.0 XSRF Create Administrator Vulnerability/title !--!Set You'r victim By SarBoT511 !-- form name=reseller action=http://site.com:2222/CMDACCOUNTADMIN method=post input...
EFS Easy Chat Server - (CSRF) Change Admin Pass Vulnerability
HTML !-- EFS Easy Chat Server XSRF Change Admin Pass Vulnerability Version: 2.2 Date: Jan 11, 2007 Size:1519KB Download Easy Chat Server http://www.echatserver.com/ecssetup.exe By Mountassif Moad -- HEAD TITLEEFS Easy Chat Server XSRF Change Admin Pass Vulnerability/TITLE SCRIPT LANGUAGE=JavaScri...
mini Hosting Panel - CSRF Change Admin Settings
No description provided by source. ----------------------------------------------------------------------------------------------- Title: mini Hosting Panel XSRF Change Admin Settings Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 14. December 2009...
CakePHP <= 1.3.5 / 1.2.8 unserialize() Vulnerability
No description provided by source. Source: http://securityreason.com/securityalert/8026 CakePHP = 1.3.5 / 1.2.8 unserialize Vulnerability felix |at| malloc.im =========================================================================== ==== Overview: CakePHP is a rapid development framework for PH...
Zoom VoIP Phone Adapater ATA1+1 1.2.5 - CSRF Exploit
No description provided by source. Written By Michael Brooks Special thanks to str0ke! Zoom VoIP Phone Adapater ATA1+1 XSRF voip provider change xsrf version 1.2.5 html form action=http://10.1.1.165/callwzd.html method=post input name=DIRTYPAGE value=3 input name=HELPPAGE value=html.html input...
vBulletin 3.7.3 - Visitor Message CSRF + Worm Exploit
No description provided by source. / ----------------------------- Author = Mx Title = vBulletin 3.7.3 Visitor Messages XSS/XSRF + worm Software = vBulletin Addon = Visitor Messages Version = 3.7.3 Attack = XSS/XSRF - Description = A critical vulnerability exists in the new vBulletin 3.7.3 softwa...
OpenKM Document Management System 5.1.7 Command Execution
No description provided by source. COMPASS SECURITY ADVISORY http://www.csnc.ch/ ID: COMPASS-2012-002 Product: OpenKM Document Management System 5.1.7 1 Vendor: OpenKM http://www.openkm.com/ Subject: Cross-site Request Forgery based OS Command Execution Risk: High Effect: Remotely exploitable...
phpMyAdmin 3.1.0 - (CSRF) SQL Injection Vulnerability
No description provided by source. Written by Michael Brooks Special Thanks to str0ke and rGod Intro: phpMyAdmin is by far the most popular PHP project. Between phpmyadmin and the xampp project there are more than 34+ million downloads from sourceforge.net . This exploit was released along side...