XSRF (CSRF) in Wolf CMS

Vulnerability ID: HTB22681 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinwolfcms.html Product: Wolf CMS Vendor: Wolf CMS team http://www.wolfcms.org/ Vulnerable Version: 0.6.0b and probably prior versions Vendor Notification: 09 November 2010 Vulnerability Type: CSRF Cross-Site Request...

XSRF (CSRF) in Frog CMS

Vulnerability ID: HTB22685 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinfrogcms.html Product: Frog CMS Vendor: Philippe Archambault http://www.madebyfrog.com/ Vulnerable Version: 0.9.5 and probably prior versions Vendor Notification: 09 November 2010 Vulnerability Type: CSRF Cross-Site...

Increase the web session timeout from 60 minutes to 300 minutes

Usability and security testing have shown that XSRF time out is annoying people in the wild. The security guy Vitaly has ok'ed the limit to be increased. This has been done on trunk along with other changes and should be done on 4.3 branch as well...

Increase the web session timeout from 60 minutes to 300 minutes

Usability and security testing have shown that XSRF time out is annoying people in the wild. The security guy Vitaly has ok'ed the limit to be increased. This has been done on trunk along with other changes and should be done on 4.3 branch as well...

Increase the web session timeout from 60 minutes to 300 minutes

Usability and security testing have shown that XSRF time out is annoying people in the wild. The security guy Vitaly has ok'ed the limit to be increased. This has been done on trunk along with other changes and should be done on 4.3 branch as well...

IBM OmniFind - Cross-Site Request Forgery

The forms in the administrator interface are not protected against XSRF. The attacker can do any action in the context of the victim. An example attack scenario could be: The attacker creates a malicious website with a prepared form to add a new user, which will be submitted on load. Exploit to a...

IBM OmniFind - Cross-Site Request Forgery

IBM OmniFind - Cross-Site Request Forgery The forms in the administrator interface are not protected against XSRF. The attacker can do any action in the context of the victim. An example attack scenario could be: The attacker creates a malicious website with a prepared form to add a new user, whi...

Zomplog 3.9 Multiple XSS & XSRF Vulnerabilities

Exploit for php platform in category web applications =============================================== Zomplog 3.9 Multiple XSS & XSRF Vulnerabilities =============================================== Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinzomplog1.html Product: Zomplog Vendor:...

Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP) Policy Bypass

, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Oracle JRE - java.net.URLConnection class – Same-of-Origin SOP Policy Bypass PDF: http://www.security-assessment.com/files/advisories/OracleJREjavaneturlconnectionSOPBypass.pdf CVE...

Oracle JRE - java.net.URLConnection class Same-of-Origin SOP Policy Bypass

Oracle JRE - java.net.URLConnection class Same-of-Origin SOP Policy Bypass Description Security-Assessment.com discovered that a Java Applet making use of java.net.URLConnection class can be used to bypass same-of-origin SOP policy and domain based security controls in modern browsers when...

XSRF (CSRF) in Lara

Vulnerability ID: HTB22619 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinlara.html Product: Lara Vendor: Geographical Media http://getlara.com/ Vulnerable Version: Current at 18.09.2010 and Probably Prior Versions Vendor Notification: 27 September 2010 Vulnerability Type: CSRF Cross-Site...

Patches for XSS / XSRF vulnerabilities

We have identified and fixed vulnerabilities in JIRA 4.2 which will allow an attacker to invoke XSS Cross Site Scripting attacks and/or Cross Site Request Forgery XSRF attacks. Full details of the severity, risks and vulnerabilities can be found in the JIRA Security Advisory...

Details Emerge on IE 8 Data-Stealing Bug

Security researcher Chris Evans has released details of the data-stealing bug in Internet Explorer 8 that he publicized earlier this month, saying that the CSS flaw can be used to force victims to post messages on Twitter and that the bug appears to be no closer to being fixed. The bug, which has...

XSRF (CSRF) in Zimplit

Vulnerability ID: HTB22605 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinzimplit.html Product: Zimplit Vendor: Zimplit Ltd. http://www.zimplit.com/ Vulnerable Version: 3.0 and Probably Prior Versions Vendor Notification: 15 September 2010 Vulnerability Type: CSRF Cross-Site Request Forgery...

Personal.Net Portal Multiple Vulnerabilities

Exploit for asp platform in category web applications ============================================ Personal.Net Portal Multiple Vulnerabilities ============================================ Title : Personal.Net Portal Multiple Vulnerabilities Affected Version : Personal.Net Portal Version 2.8.1...

Month Of Abysssec Undisclosed Bugs - Personal.Net Portal

''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ ''' Abysssec Inc Public Advisory Title : Personal.Net Portal Multiple Vulnerabilities Affected Version : Personal.Net Portal Version 2.8.1 Discovery : www.Abysssec.com Vendor...

Personal.Net Portal - Multiple Vulnerabilities

Personal.Net Portal - Multiple Vulnerabilities ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ ''' Abysssec Inc Public Advisory Title : Personal.Net Portal Multiple Vulnerabilities Affected Version : Personal.Net Portal...

CMSimple XSRF Vulnerability

Exploit for php platform in category web applications =========================== CMSimple XSRF Vulnerability =========================== - Title : CMSimple XSRF Vulnerability - Affected Version :CMSimple $v1 if isarray$v1 foreach$v1 as $k2 = $v2 if !isarray$v2 initvar$k1.''.$k2; $GLOBALS$a$k1$k2...

CMSimple - Cross-Site Request Forgery

''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | $v1 if isarray$v1 foreach$v1 as $k2 = $v2 if !isarray$v2 initvar$k1.''.$k2; $GLOBALS$a$k1$k2 = $GLOBALS$k1.''.$k2; $GLOBALS$a$k1$k2 = stsl$GLOBALS$a$k1$k2; if $k1.$k2 == 'editorbuttons'$text .=...

Month Of Abysssec Undisclosed Bugs - phpmyfamily 1.4.2

''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moaub-17-phpmyfamily-multiple-remote-vulnerabilities/ ''' - Title : phpmyfamily Multiple Remote Vulnerabilities. - Affected Version : phpmyfamily =...