HTB22898: XSRF (CSRF) in Ripe website manager

Vulnerability ID: HTB22898 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinripewebsitemanager.html Product: Ripe website manager Vendor: Ripe website manager Team http://www.ripewebsitemanager.com/ Vulnerable Version: 1.1 and probably prior versions Vendor Notification: 10 March 2011...

Lotus CMS 3.0.3 XSRF / XSS / File Content Disclosure

============================ Vulnerability ID: HTB22888 Reference: http://www.htbridge.ch/advisory/filecontentdisclosureinlotuscms.html Product: LotusCMS Vendor: Arboroia Network http://www.lotuscms.org/ Vulnerable Version: 3.0.3 and probably prior versions Vendor Notification: 01 March 2011...

HTB22886: XSRF (CSRF) in LotusCMS

Vulnerability ID: HTB22886 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinlotuscms.html Product: LotusCMS Vendor: Arboroia Network http://www.lotuscms.org/ Vulnerable Version: 3.0.3 and probably prior versions Vendor Notification: 01 March 2011 Vulnerability Type: CSRF Cross-Site Request...

XSRF token broken when you edit an Issue Type Scheme

If you click the Edit link beside the currently selected Issue Type Scheme on a Project Summary page and then click Save on the next screen you get an XSRF token missing error...

XSRF token broken when you edit an Issue Type Scheme

If you click the Edit link beside the currently selected Issue Type Scheme on a Project Summary page and then click Save on the next screen you get an XSRF token missing error...

XSRF token broken when you edit an Issue Type Scheme

If you click the Edit link beside the currently selected Issue Type Scheme on a Project Summary page and then click Save on the next screen you get an XSRF token missing error...

HTB22855: XSRF (CSRF) in Pragyan CMS

Vulnerability ID: HTB22855 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinpragyancms.html Product: Pragyan CMS Vendor: Pragyan Team http://sourceforge.net/projects/pragyan/ Vulnerable Version: v.3.0 beta Vendor Notification: 17 February 2011 Vulnerability Type: CSRF Cross-Site Request Forge...

Drupal CAPTCHA Logic Security Flaw

Drupal Captcha bruteforcing bypass This is a Proof Of Concept to demonstrate a logic security flow in the way drupal captcha is used to protect login forms from bruteforce. If the captcha challenge is solved, the next login attempts can be issued without solving any new captcha challenge. Usage:...

HTB22812: XSRF (CSRF) in UMI.CMS

Vulnerability ID: HTB22812 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinumicms.html Product: UMI.CMS Vendor: umisoft http://www.umi-cms.ru/ Vulnerable Version: 2.8.1.2 Vendor Notification: 25 January 2011 Vulnerability Type: CSRF Cross-Site Request Forgery Risk level: Low Credit: High-Tec...

Comcast DOCSIS 3.0 Business Gateways XSRF / Session Management

Trustwave's SpiderLabs Security Advisory TWSL2011-001: Vulnerabilities in Comcast DOCSIS 3.0 Business Gateways SMCD3G-CCR https://www.trustwave.com/spiderlabs/advisories/TWSL2011-002.txt Published: 2011-02-04 Version: 1.0 Vendor: Comcast http://comcast.com and SMC http://www.smc.com Product:...

HTB22793: XSRF (CSRF) in KaiBB

Vulnerability ID: HTB22793 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinkaibb.html Product: KaiBB Vendor: Mi-Dia http://www.kaibb.co.uk/ Vulnerable Version: 1.0.2 and probably prior versions Vendor Notification: 13 January 2011 Vulnerability Type: CSRF Cross-Site Request Forgery Status:...

CakePHP 1.3.5/1.2.8 - 'Unserialize()' File Inclusion

Source: http://securityreason.com/securityalert/8026 CakePHP data; $token = urldecode$check'Token''fields'; if strpos$token, ':' list$token, $locked = explode':', $token, 2; $locked = unserializestrrot13$locked; -- snip -- The $check array contains our POST data and $locked is a simple rot-13...

XSRF (CSRF) in whCMS

Vulnerability ID: HTB22767 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinwhcms.html Product: whCMS Vendor: Joram van den Boezem http://whcms.burolaga.nl/ Vulnerable Version: 0.115 alpha and probably prior versions Vendor Notification: 28 December 2010 Vulnerability Type: CSRF Cross-Site...

XSRF (CSRF) in diafan.CMS

Vulnerability ID: HTB22777 Reference: http://www.htbridge.ch/advisory/xsrfcsrfindiafancms.html Product: diafan.CMS Vendor: Diafan http://www.diafan.ru/ Vulnerable Version: 4.3 and probably prior versions Vendor Notification: 28 December 2010 Vulnerability Type: CSRF Cross-Site Request Forgery...

XSRF (CSRF) in Cambio

Vulnerability ID: HTB22768 Reference: http://www.htbridge.ch/advisory/xsrfcsrfincambio.html Product: Cambio Vendor: Joram van den Boezem http://www.cambiocms.org/ Vulnerable Version: 0.5a nightly r37 and probably prior versions Vendor Notification: 28 December 2010 Vulnerability Type: CSRF...

XSRF (CSRF) in Energine

Vulnerability ID: HTB22782 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinenergine.html Product: Energine Vendor: Energine http://www.energine.org/ Vulnerable Version: 2.3.8 and probably prior versions Vendor Notification: 28 December 2010 Vulnerability Type: CSRF Cross-Site Request Forgery...

XSRF (CSRF) in VaM Shop

Vulnerability ID: HTB22780 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinvamshop.html Product: VaM Shop Vendor: Vamsoft http://vamshop.ru/ Vulnerable Version: 1.6 and Probably Prior Versions Vendor Notification: 28 December 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status: N...

XSRF (CSRF) in F3Site

Vulnerability ID: HTB22757 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinf3site.html Product: F3Site Vendor: COMPMaster http://dhost.info/compmaster/ Vulnerable Version: 2011 alfa 1 and probably prior versions Vendor Notification: 21 December 2010 Vulnerability Type: CSRF Cross-Site Reques...

OpenAuto 1.6.3 Multiple Vulnerabilities

Exploit for php platform in category web applications Credit:Michael Brooks Affects:OpenAuto 1.6.3 Vulnerabilites: XSRF/XSS/Blind SQLi/Captcha Bypass http://openautoclassifieds.com/ ---------------------------------------------------------------------------------------------------- Reflective XSS...

Vacation Rental Script v4.0 XSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Vacation Rental Script v4.0 XSRF VULNERABILTY Google Dork: "2006 - 2009 Vacation Rental Script" Date: 24.12.2010 Author: OnurTURKESHAN Software Link: http://www.vacationrentalscript.com/ Version: v.4.0 Tested on: v4.0 TEsted...