Qool CMS v2.0 RC2 - Multiple Vulnerabilities

Exploit for php platform in category web applications Qool CMS v2.0 RC2 XSRF Add Root Exploit input type="hidden" name="email" value="email pro...

Qool CMS 2.0 RC2 Cross Site Request Forgery

Qool CMS v2.0 RC2 XSRF Add Root Exploit input type="hidden" name="...

Qool CMS 2.0 RC2 - Multiple Vulnerabilities

Qool CMS v2.0 RC2 XSRF Add Root Exploit in...

Qool CMS v2.0 RC2 XSRF Add Root Exploit

Summary Qool CMS is a content management system that helps web masters be more productive. Qool has been built with both worlds web master, web developer in mind. It is easy to create addons extensions for the system but you can really do without them too. Description Qool CMS allows users to...

Opera < 12.13 Multiple Vulnerabilities

Binary data 6680.prm...

Opera < 12.13 Multiple Vulnerabilities

Binary data 800848.prm...

CORS requests can omit the preflight request

Cross-Origin Resource Sharing CORS requests are required to send a preflight request if custom headers are included, to check that the host wishes to allow the full request to be made. An example of where this may be needed is for sites that use a custom header with a static value as part of thei...

CubeCart 4.4.6 Cross Site Request Forgery

OVERVIEW CubeCart 4.4.6 and lower versions are vulnerable to Cross Site Request Forgery CSRF. 2. BACKGROUND CubeCart is an "out of the box" ecommerce shopping cart software solution which has been written to run on servers that have PHP & MySQL support. With CubeCart you can quickly setup a...

Apache Tomcat 7.0.x < 7.0.32 CSRF Filter Bypass

Binary data 6644.pasl...

BuildEdgeIndexServlet XSRF

The BuildEdgeIndexServlet is responsible for rebuilding the edge index. As this is a servlet and not a Webwork action, XSRF checks must be implemented programmatically. The Servlet does not currently implement any XSRF token checks, meaning the edge index can be forced to be rebuilt when attacked...

BuildEdgeIndexServlet XSRF

The BuildEdgeIndexServlet is responsible for rebuilding the edge index. As this is a servlet and not a Webwork action, XSRF checks must be implemented programmatically. The Servlet does not currently implement any XSRF token checks, meaning the edge index can be forced to be rebuilt when attacked...

UploadAttachmentsAction XSRF

The UploadAttachmentsAction action is declared to use a validatingStack interceptor chain, but does not use the RequiresSecurityToken element, leaving it open to an XSRF attack. If this were exploited, an attacker could force a user’s browser to upload files into a space they have write permissio...

UploadAttachmentsAction XSRF

The UploadAttachmentsAction action is declared to use a validatingStack interceptor chain, but does not use the RequiresSecurityToken element, leaving it open to an XSRF attack. If this were exploited, an attacker could force a user’s browser to upload files into a space they have write permissio...

Mozilla Thunderbird < 17.0 Multiple Vulnerabilities

Binary data 6627.prm...

Mozilla SeaMonkey 2.x <= 2.13 Multiple Vulnerabilities

Binary data 801336.prm...

Mozilla Firefox < 17.0 Multiple Vulnerabilities

Binary data 6625.prm...

Mozilla Thunderbird 16.x <= 16 Multiple Vulnerabilities

Binary data 801350.prm...

Apache Tomcat 6.0.x < 6.0.36 Multiple Vulnerabilities

Binary data 6657.pasl...

Apache Tomcat 6.0.x < 6.0.36 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat 6.0 listening on the remote host is prior to Tomcat 6.0.36. It is, therefore, affected by multiple vulnerabilities : - A flaw exists within the parseHeaders function that allows for a crafted header to cause a remote...

Webwork direct method invocation can bypass validatingStack through Action aliases

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-27294. panel WebWork supports the concept of action aliases, which allow a single action class to serve requests mapping to...