933 matches found
Log1cms v2.1 Multiple XSRF File (Upload/Download) Vulnerabilities
Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...
BrewBlogger 2.3.2 CSRF / SQL Injection / Shell Upload
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...
BrewBlogger v2.3.2 Multiple (XSRF/ShellUpload/SQLi) Vulnerabilities
Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...
PBBoard v2.1.4 <= Multiple Vulnerabilites
Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...
Zen-Cart 1.3.9h Cross Site Request Forgery
Advisory Information Title: Zen-Cart Admin CSRF/XSRF - Delete / Disable Products Date published: 2012-02-10 01:59:45 AM upSploit Ref: UPS-2011-0018 CVE REF: CVE-2011-4403 Advisory Summary An attacker can force an administrator to delete or disable products from within his store. Vendor Zen-Cart...
Cisco IOS XSS and XSRF Vulnerabilities
On June 19, 2009, Cisco released a security response for cross-site scripting and cross-site request forgery vulnerabilities in the HTTP server in IOS. Exploitation of these vulnerabilities could result in attacker supplied JavaScript or HTML being injected into web pages. Further, a remote...
OpenKM 5.1.7 OS Command Execution (XSRF based)
COMPASS SECURITY ADVISORY http://www.csnc.ch/ ID: COMPASS-2012-002 Product: OpenKM Document Management System 5.1.7 1 Vendor: OpenKM http://www.openkm.com/ Subject: Cross-site Request Forgery based OS Command Execution Risk: High Effect: Remotely exploitable Author: Cyrill Brunschwiler...
Trend Micro Control Manager CSRF
A cross-site request forgery XSRF vulnerability has been reported in Trend Micro Control Manager...
OpenKM Document Management System 5.1.7 - Command Execution
OpenKM Document Management System 5.1.7 - Command Execution COMPASS SECURITY ADVISORY http://www.csnc.ch/ ID: COMPASS-2012-002 Product: OpenKM Document Management System 5.1.7 1 Vendor: OpenKM http://www.openkm.com/ Subject: Cross-site Request Forgery based OS Command Execution Risk: High Effect:...
OpenKM Document Management System 5.1.7 Command Execution
COMPASS SECURITY ADVISORY http://www.csnc.ch/ ID: COMPASS-2012-002 Product: OpenKM Document Management System 5.1.7 1 Vendor: OpenKM http://www.openkm.com/ Subject: Cross-site Request Forgery based OS Command Execution Risk: High Effect: Remotely exploitable Author: Cyrill Brunschwiler...
Trend Micro Control Manager CasLogDirectInsertHandler.cs XSRF
cross-site request forgery XSRF vulnerability has been reported in Trend Micro Control Manager. The vulnerability is due to an error while handling CasLogDirectInsert.aspx requests. A remote attacker may exploit this vulnerability by enticing a user to open a specially crafted URI. Successful...
Drupal String Overrides Cross Site Scripting
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vulnerability Report Reported to Vendor: March 16, 2011 15:25 EST Description of Vulnerability: - ----------------------------- Drupal http://drupal.org is a robust content management system CMS written in PHP and MySQL. The Drupal String Overrides...
LedgerSMB 1.3.0 released, includes anti-XSRF framework
Hi all; LedgerSMB 1.3.0 has been released. One of the important enhancements this version has is protection against cross-site request forgery XSRF, notably missing in past versions. The codebase we inherited when beginning the project has not been very conducive to retrofitting security framewor...
Actions doeditpage,domovepage,docreatepage do not require XSRF token
When checking the application for security leaks, I found that the actions doeditpage, domovepage and docreatepage explicitly set the requireSecurityToken=false in the xwork.xml. This could be a possible leak in an attack scenario. Is there a reason, why these actions should not require the...
Actions doeditpage,domovepage,docreatepage do not require XSRF token
When checking the application for security leaks, I found that the actions doeditpage, domovepage and docreatepage explicitly set the requireSecurityToken=false in the xwork.xml. This could be a possible leak in an attack scenario. Is there a reason, why these actions should not require the...
Check Point UTM-1 Edge and Safe 8.2.43 - Multiple Vulnerabilities
source: https://www.securityfocus.com/bid/50189/info Check Point UTM-1 Edge and Safe are prone to multiple security vulnerabilities, including: 1. Multiple cross-site scripting vulnerabilities 2. Multiple HTML-injection vulnerabilities 3. Multiple cross-site request forgery vulnerabilities 4...
Roundcube Webmail 0.3.1 - Cross-Site Request Forgery SQL Injection
Roundcube Webmail 0.3.1 - Cross-Site Request Forgery SQL Injection Exploit Title: RoundCube 0.3.1 SQL injection Date: 10/10/2011 Author: Smith Falcon Software Link: http://roundcube.net/download Version: 0.3.1 Tested on: Linux timezone= is vulnerable to SQL Union Injection. "POST" data in...
ServersCheck Monitoring 8.8.6 Session Hijacking / XSRF
Title: ====== ServersCheck Monitoring v8.8.6 - Multiple Web Vulnerabilities Date: ===== 2011-09-27 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=93 VL-ID: ===== 93 Introduction: ============= ServersCheck is a Belgian based and privately owned technology company found...
SiT! Support Incident Tracker 3.64 XSS / XSRF / SQL Injection
Vulnerability ID: HTB23043 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinsitsupportincidenttracker.html Product: SiT! Support Incident Tracker Vendor: The Support Incident Tracker Project http://sitracker.org/ Vulnerable Version: 3.64 and probably prior Tested Version: 3.64...
Zazavi <=1.2.1 Multiple (XSRF + Shell Upload) Vulnerabilities
Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...