Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

Narendra Bhati

Narendra Bhati

Security Analyst · Not a member

Narendra Bhati's latest activity

Sunday, November 16 2014
1233 Critical Click Jacking Vulnerability In 2.3.1 was created in Exponent CMS
  • Narendra Bhati
    Narendra Bhati created the ticket at 10:44 AM

    Hello Exponent

    while looking into your cms i found that its vulnerable to click jacking

    by using clickjacking an attacker can directly bypass the referer based ...
Friday, November 14 2014
1232 Critical CSRF Vulnerability was updated in Exponent CMS
  • Narendra Bhati
    Narendra Bhati commented at 3:18 PM

    i will find the same issue "CSRF" in your new cms version which is 2.3.1 and report it to you with new ticket
  • Narendra Bhati
    • Assigned user set to expNinja
    by Narendra Bhati at 3:17 PM

    i am talking about csrf not xss !
Thursday, November 06 2014
1232 Critical CSRF Vulnerability was created in Exponent CMS
1179 Possible 0 Days Security Issue??? was updated in Exponent CMS
Saturday, October 18 2014
1179 Possible 0 Days Security Issue??? was updated in Exponent CMS
  • Narendra Bhati
    Narendra Bhati commented at 8:33 AM

    Any update regarding the issue or CVE ID ?
Sunday, September 21 2014
1179 Possible 0 Days Security Issue??? was updated in Exponent CMS
  • Narendra Bhati
    • Assigned user set to expNinja
    by Narendra Bhati at 5:27 PM

    Any update ragarding the issue
    Hope you will apply for CVE Id
Friday, July 11 2014
1179 Possible 0 Days Security Issue??? was updated in Exponent CMS
Thursday, July 10 2014
1179 Possible 0 Days Security Issue??? was updated in Exponent CMS
Wednesday, July 09 2014
1179 Possible 0 Days Security Issue??? was updated in Exponent CMS
  • Narendra Bhati
    Narendra Bhati commented at 8:11 PM

    no your many parts are vulnerable with xss
    Now i want to introduce an another issue which is CSRF

    Because your web cmd in not using any kind of tokens for valid...