CWE-352 · Cross-Site Request Forgery (CSRF) (page 55)
Page 55 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29557 | High | 8.8 | 2023-02-15 | LexisNexis Firco Compliance Link 3.7 allows CSRF. |
CVE-2023-22942 | Medium | 5.4 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST… |
CVE-2023-25065 | Medium | 5.4 | 2023-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions. |
CVE-2023-24382 | Medium | 5.4 | 2023-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions. |
CVE-2023-24377 | Medium | 5.4 | 2023-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 versions. |
CVE-2022-46862 | Medium | 4.3 | 2023-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 version… |
CVE-2023-25066 | Medium | 4.3 | 2023-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions. |
CVE-2022-43469 | Medium | 5.4 | 2023-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data plugin <= 1.7.0.6 versions. |
CVE-2023-22375 | High | 8.8 | 2023-02-14 | Cross-site request forgery (CSRF) vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker t… |
CVE-2022-4138 | Medium | 6.4 | 2023-02-13 | A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and… |
CVE-2022-41134 | Medium | 5.4 | 2023-02-13 | Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions. |
CVE-2022-34448 | High | 8.8 | 2023-02-11 | PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Cross-site Request Forgery vulnerability. An unauthenticated non-privileged use… |
CVE-2022-3568 | High | 8.8 | 2023-02-10 | The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1… |
CVE-2022-41620 | Medium | 5.4 | 2023-02-08 | Cross-Site Request Forgery (CSRF) vulnerability in SeoSamba for WordPress Webmasters plugin <= 1.0.5 versions. |
CVE-2023-0726 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0725 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0724 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0722 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0685 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0735 | Medium | 6.5 | 2023-02-07 | Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4. |
CVE-2023-0730 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0727 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0723 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0728 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2022-2933 | Medium | 5.4 | 2023-02-06 | The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect n… |
CVE-2022-27628 | Medium | 4.7 | 2023-02-06 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team WZone – Lite Version plugin 3.1 Lite versions. |
CVE-2023-0674 | Medium | 4.3 | 2023-02-04 | A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/u… |
CVE-2021-37234 | Medium | 6.5 | 2023-02-03 | Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive inform… |
CVE-2021-36570 | High | 8.8 | 2023-02-03 | Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---. |
CVE-2021-36569 | High | 8.8 | 2023-02-03 | Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2. |
CVE-2021-36444 | High | 8.8 | 2023-02-03 | Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the ad… |
CVE-2021-36443 | High | 8.8 | 2023-02-03 | Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification. |
CVE-2022-47132 | High | 8.8 | 2023-02-03 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users. |
CVE-2022-47131 | Medium | 4.8 | 2023-02-03 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page. |
CVE-2022-47130 | Medium | 4.3 | 2023-02-03 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privilege… |
CVE-2022-46842 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in JS Help Desk plugin <= 2.7.1 versions. |
CVE-2022-46815 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 versions. |
CVE-2022-45807 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) in WPVibes WP Mail Log plugin <= 1.0.1 versions. |
CVE-2022-45067 | Medium | 4.3 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in DevsCred Exclusive Addons Elementor plugin <= 2.6.1 versions. |
CVE-2022-44585 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions. |
CVE-2022-40692 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions. |
CVE-2022-36401 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommerce plugin <= 1.3.24 versions. |
CVE-2023-0642 | Medium | 6.5 | 2023-02-02 | Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0. |
CVE-2023-25015 | Medium | 6.5 | 2023-02-02 | Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF. |
CVE-2023-23750 | Medium | 6.3 | 2023-02-01 | An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages. |
CVE-2023-20856 | High | 8.8 | 2023-02-01 | VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenti… |
CVE-2022-32516 | High | 7.5 | 2023-01-30 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could cause system’s configurations override and cause a reboot loop when the product su… |
CVE-2022-4872 | Medium | 4.3 | 2023-01-30 | The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option to be updated belon… |
CVE-2022-4553 | Medium | 4.3 | 2023-01-30 | The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating reseting moods which could allow attackers to make logged in admins perfo… |
CVE-2022-4552 | Medium | 6.1 | 2023-01-30 | The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could… |
CVE-2022-43980 | Medium | 5.2 | 2023-01-27 | There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, inc… |
CVE-2023-0554 | High | 8.1 | 2023-01-27 | The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or i… |
CVE-2021-21395 | Medium | 4.2 | 2023-01-27 | Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable… |
CVE-2023-24458 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2023-24457 | Medium | 6.5 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in t… |
CVE-2023-24452 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2023-24447 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP… |
CVE-2023-24446 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's ac… |
CVE-2023-24437 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an att… |
CVE-2023-24434 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-s… |
CVE-2023-24432 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HT… |
CVE-2023-24428 | Medium | 5.7 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the att… |
CVE-2023-24423 | Medium | 6.5 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by… |
CVE-2022-37719 | High | 8.8 | 2023-01-23 | A Cross-Site Request Forgery (CSRF) in the management portal of JetNexus/EdgeNexus ADC 4.2.8 allows attackers to escalate privileges and execute arbitrary code… |
CVE-2022-4548 | Medium | 6.5 | 2023-01-23 | The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its settings, which could a… |
CVE-2023-0438 | Medium | 6.5 | 2023-01-23 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2023-0406 | Medium | 4.3 | 2023-01-19 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2023-0403 | Medium | 5.4 | 2023-01-19 | The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrec… |
CVE-2023-0398 | Medium | 6.5 | 2023-01-19 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2023-0385 | Medium | 4.3 | 2023-01-18 | The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to missing or incorrec… |
CVE-2022-47395 | High | 8.1 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor serv… |
CVE-2022-45127 | High | 8.1 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its backup servi… |
CVE-2022-4621 | High | 7.5 | 2023-01-17 | Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are vulnerable to CSRFs that can be exploited to allow an attacker to perform changes with… |
CVE-2023-22286 | High | 8.1 | 2023-01-17 | Cross-site request forgery (CSRF) vulnerability in MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver… |
CVE-2022-30544 | Medium | 4.3 | 2023-01-17 | Cross-Site Request Forgery (CSRF) in MiKa's OSM – OpenStreetMap plugin <= 6.0.1 versions. |
CVE-2022-43719 | High | 8.8 | 2023-01-16 | Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 an… |
CVE-2023-22852 | Medium | 6.5 | 2023-01-14 | Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php. |
CVE-2023-0294 | High | 8.8 | 2023-01-13 | The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.1. This is due to… |
CVE-2022-46368 | Medium | 6.8 | 2023-01-12 | Rumpus - FTP server version 9.0.7.1 Cross-site request forgery (CSRF) – vulnerability may allow unauthorized action on behalf of authenticated users. |
CVE-2022-46367 | Medium | 6.8 | 2023-01-12 | Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation vulnerability that may allow privilege escalation. |
CVE-2022-4707 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing no… |
CVE-2022-4103 | Medium | 4.3 | 2023-01-09 | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the po… |
CVE-2022-4102 | Low | 3.1 | 2023-01-09 | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the pos… |
CVE-2023-22472 | Medium | 5.3 | 2023-01-09 | Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user… |
CVE-2023-0088 | High | 8.8 | 2023-01-05 | The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or inc… |
CVE-2023-0086 | Medium | 5.4 | 2023-01-05 | The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing… |
CVE-2016-15009 | Low | 3.5 | 2023-01-05 | A vulnerability classified as problematic has been found in OpenACS bug-tracker. Affected is an unknown function of the file lib/nav-bar.adp of the component S… |
CVE-2023-22457 | Critical | 9.0 | 2023-01-04 | CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection… |
CVE-2022-42435 | Medium | 4.3 | 2023-01-04 | IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to c… |
CVE-2022-3911 | High | 8.8 | 2023-01-02 | The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belon… |
CVE-2014-125028 | Medium | 4.3 | 2022-12-31 | A vulnerability was found in valtech IDP Test Client and classified as problematic. Affected by this issue is some unknown functionality of the file python-fla… |
CVE-2022-4867 | Medium | 4.3 | 2022-12-31 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-4850 | Medium | 6.5 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4849 | Medium | 6.5 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4846 | Medium | 6.5 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4845 | Medium | 4.3 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4844 | High | 8.8 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2016-15005 | High | 8.8 | 2022-12-27 | CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass C… |
CVE-2022-4766 | Medium | 4.3 | 2022-12-27 | A vulnerability was found in dolibarr_project_timesheet up to 4.5.5. It has been declared as problematic. This vulnerability affects unknown code of the compon… |
CVE-2020-36633 | Medium | 4.3 | 2022-12-27 | A vulnerability was found in moodle-block_sitenews 1.0. It has been classified as problematic. This affects the function get_content of the file block_sitenews… |