Vacation Rental Script 4.0 Cross Site Request Forgery

Exploit Title: Vacation Rental Script v4.0 XSRF VULNERABILTY Google Dork: "2006 - 2009 Vacation Rental Script" Date: 24.12.2010 Author: OnurTURKESHAN Software Link: http://www.vacationrentalscript.com/ Version: v.4.0 Tested on: v4.0 TEsted +WorKs ResPecT My FrienDz :...

openauto 1.6.3 - Multiple Vulnerabilities

openauto 1.6.3 - Multiple Vulnerabilities Credit:Michael Brooks Affects:OpenAuto 1.6.3 Vulnerabilites: XSRF/XSS/Blind SQLi/Captcha Bypass http://openautoclassifieds.com/ ---------------------------------------------------------------------------------------------------- Reflective XSS by adding a...

openauto 1.6.3 - Multiple Vulnerabilities

Credit:Michael Brooks Affects:OpenAuto 1.6.3 Vulnerabilites: XSRF/XSS/Blind SQLi/Captcha Bypass http://openautoclassifieds.com/ ---------------------------------------------------------------------------------------------------- Reflective XSS by adding a onclick event handler...

XSRF (CSRF) in BEdita

Vulnerability ID: HTB22729 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinbedita.html Product: BEdita Vendor: Chialab ChannelWeb http://www.bedita.com/ Vulnerable Version: 3.0.1.2550 "betula" and probably prior versions Vendor Notification: 30 November 2010 Vulnerability Type: CSRF Cross-Si...

XSRF (CSRF) in BLOG:CMS

Vulnerability ID: HTB22727 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinblogcms.html Product: BLOG:CMS Vendor: Radek Hulan http://blogcms.com/ Vulnerable Version: 4.2.1.e and probably prior versions Vendor Notification: 30 November 2010 Vulnerability Type: CSRF Cross-Site Request Forgery...

XSRF (CSRF) in CMScout

Vulnerability ID: HTB22719 Reference: http://www.htbridge.ch/advisory/xsrfcsrfincmscout.html Product: CMScout Vendor: CMScout Team http://www.cmscout.co.za/ Vulnerable Version: 2.09 and probably prior versions Vendor Notification: 25 November 2010 Vulnerability Type: CSRF Cross-Site Request Forge...

XSRF (CSRF) in Frog CMS

Vulnerability ID: HTB22685 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinfrogcms.html Product: Frog CMS Vendor: Philippe Archambault http://www.madebyfrog.com/ Vulnerable Version: 0.9.5 and probably prior versions Vendor Notification: 09 November 2010 Vulnerability Type: CSRF Cross-Site...

XSRF (CSRF) in Wolf CMS

Vulnerability ID: HTB22681 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinwolfcms.html Product: Wolf CMS Vendor: Wolf CMS team http://www.wolfcms.org/ Vulnerable Version: 0.6.0b and probably prior versions Vendor Notification: 09 November 2010 Vulnerability Type: CSRF Cross-Site Request...

Increase the web session timeout from 60 minutes to 300 minutes

Usability and security testing have shown that XSRF time out is annoying people in the wild. The security guy Vitaly has ok'ed the limit to be increased. This has been done on trunk along with other changes and should be done on 4.3 branch as well...

Increase the web session timeout from 60 minutes to 300 minutes

Usability and security testing have shown that XSRF time out is annoying people in the wild. The security guy Vitaly has ok'ed the limit to be increased. This has been done on trunk along with other changes and should be done on 4.3 branch as well...

Increase the web session timeout from 60 minutes to 300 minutes

Usability and security testing have shown that XSRF time out is annoying people in the wild. The security guy Vitaly has ok'ed the limit to be increased. This has been done on trunk along with other changes and should be done on 4.3 branch as well...

IBM OmniFind - Cross-Site Request Forgery

IBM OmniFind - Cross-Site Request Forgery The forms in the administrator interface are not protected against XSRF. The attacker can do any action in the context of the victim. An example attack scenario could be: The attacker creates a malicious website with a prepared form to add a new user, whi...

IBM OmniFind - Cross-Site Request Forgery

The forms in the administrator interface are not protected against XSRF. The attacker can do any action in the context of the victim. An example attack scenario could be: The attacker creates a malicious website with a prepared form to add a new user, which will be submitted on load. Exploit to a...

Zomplog 3.9 Multiple XSS & XSRF Vulnerabilities

Exploit for php platform in category web applications =============================================== Zomplog 3.9 Multiple XSS & XSRF Vulnerabilities =============================================== Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinzomplog1.html Product: Zomplog Vendor:...

Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP) Policy Bypass

, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Oracle JRE - java.net.URLConnection class – Same-of-Origin SOP Policy Bypass PDF: http://www.security-assessment.com/files/advisories/OracleJREjavaneturlconnectionSOPBypass.pdf CVE...

Oracle JRE - java.net.URLConnection class Same-of-Origin SOP Policy Bypass

Oracle JRE - java.net.URLConnection class Same-of-Origin SOP Policy Bypass Description Security-Assessment.com discovered that a Java Applet making use of java.net.URLConnection class can be used to bypass same-of-origin SOP policy and domain based security controls in modern browsers when...

XSRF (CSRF) in Lara

Vulnerability ID: HTB22619 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinlara.html Product: Lara Vendor: Geographical Media http://getlara.com/ Vulnerable Version: Current at 18.09.2010 and Probably Prior Versions Vendor Notification: 27 September 2010 Vulnerability Type: CSRF Cross-Site...

Patches for XSS / XSRF vulnerabilities

We have identified and fixed vulnerabilities in JIRA 4.2 which will allow an attacker to invoke XSS Cross Site Scripting attacks and/or Cross Site Request Forgery XSRF attacks. Full details of the severity, risks and vulnerabilities can be found in the JIRA Security Advisory...

Details Emerge on IE 8 Data-Stealing Bug

Security researcher Chris Evans has released details of the data-stealing bug in Internet Explorer 8 that he publicized earlier this month, saying that the CSS flaw can be used to force victims to post messages on Twitter and that the bug appears to be no closer to being fixed. The bug, which has...

XSRF (CSRF) in Zimplit

Vulnerability ID: HTB22605 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinzimplit.html Product: Zimplit Vendor: Zimplit Ltd. http://www.zimplit.com/ Vulnerable Version: 3.0 and Probably Prior Versions Vendor Notification: 15 September 2010 Vulnerability Type: CSRF Cross-Site Request Forgery...