CWE-352 · Cross-Site Request Forgery (CSRF) (page 58)
Page 58 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41249 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP se… |
CVE-2022-41245 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers to connect to an attacke… |
CVE-2022-41236 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Security Inspector Plugin 117.v6eecc36919c2 and earlier allows attackers to replace the generated… |
CVE-2022-41232 | High | 8.0 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jen… |
CVE-2022-41227 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect t… |
CVE-2022-23685 | High | 8.8 | 2022-09-20 | A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a lack of Cross-Site Request Forgery (CSR… |
CVE-2022-35196 | High | 8.8 | 2022-09-20 | TestLink v1.9.20 was discovered to contain a Cross-Site Request Forgery (CSRF) via /lib/plan/planView.php. |
CVE-2022-1591 | Medium | 4.3 | 2022-09-19 | The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to ma… |
CVE-2022-3232 | Medium | 4.3 | 2022-09-17 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.5. |
CVE-2022-29489 | Medium | 4.3 | 2022-09-16 | Cross-Site Request Forgery (CSRF) vulnerability in Sucuri Security plugin <= 1.8.33 at WordPress leading to Event log entry creation. |
CVE-2022-3221 | High | 8.8 | 2022-09-15 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3. |
CVE-2022-40623 | High | 8.8 | 2022-09-13 | The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with other issues (such a… |
CVE-2022-38329 | Medium | 4.3 | 2022-09-13 | A CSRF vulnerability in Shopxian CMS 3.0.0 could allow an unauthenticated, remote attacker to craft a malicious link, potentially causing the administrator to… |
CVE-2022-32555 | High | 8.8 | 2022-09-13 | Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST request. Thus, a cross-si… |
CVE-2022-38139 | Medium | 5.4 | 2022-09-13 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin <= 5.2.0 at WordPress. |
CVE-2022-38144 | High | 8.8 | 2022-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress. |
CVE-2022-38093 | Medium | 5.4 | 2022-09-09 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress. |
CVE-2022-38059 | Medium | 5.5 | 2022-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress. |
CVE-2022-37411 | Medium | 5.4 | 2022-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza's Captcha Code plugin <= 2.7 at WordPress. |
CVE-2022-37405 | Medium | 4.3 | 2022-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress. |
CVE-2022-35277 | Medium | 5.4 | 2022-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in GetResponse plugin <= 5.5.20 at WordPress. |
CVE-2022-36095 | Medium | 4.3 | 2022-09-08 | XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding… |
CVE-2022-37730 | High | 8.8 | 2022-09-07 | In ftcms 2.1, there is a Cross Site Request Forgery (CSRF) vulnerability in the PHP page, which causes the attacker to forge a link to trick him to click on a… |
CVE-2022-33177 | Medium | 5.4 | 2022-09-06 | Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations Update. |
CVE-2022-2542 | High | 8.8 | 2022-09-06 | The uContext for Clickbank plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. Thi… |
CVE-2022-2541 | High | 8.8 | 2022-09-06 | The uContext for Amazon plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This i… |
CVE-2022-2540 | High | 8.8 | 2022-09-06 | The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 1.4.5. This i… |
CVE-2022-2518 | High | 8.8 | 2022-09-06 | The Stockists Manager for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.2.1. This is due t… |
CVE-2022-2432 | High | 8.8 | 2022-09-06 | The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23. This is due to mi… |
CVE-2022-2233 | High | 8.8 | 2022-09-06 | The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protectio… |
CVE-2022-23680 | High | 8.8 | 2022-09-06 | AOS-CX lacks Anti-CSRF protections in place for state-changing operations. This can potentially be exploited by an attacker to execute commands in the context… |
CVE-2022-23679 | High | 8.8 | 2022-09-06 | AOS-CX lacks Anti-CSRF protections in place for state-changing operations. This can potentially be exploited by an attacker to execute commands in the context… |
CVE-2022-3121 | Medium | 4.3 | 2022-09-05 | A vulnerability was found in SourceCodester Online Employee Leave Management System 1.0. It has been declared as problematic. Affected by this vulnerability is… |
CVE-2022-2657 | Medium | 4.3 | 2022-09-05 | The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could all… |
CVE-2022-36076 | High | 8.8 | 2022-09-02 | NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the cod… |
CVE-2021-29823 | Medium | 6.5 | 2022-09-01 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… |
CVE-2021-20468 | Medium | 6.5 | 2022-09-01 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… |
CVE-2020-4301 | Medium | 6.5 | 2022-09-01 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… |
CVE-2022-36796 | Medium | 6.1 | 2022-09-01 | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking plugin <= 0.4.9 at… |
CVE-2022-36373 | Medium | 5.4 | 2022-09-01 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress. |
CVE-2022-3017 | Medium | 6.5 | 2022-08-28 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38. |
CVE-2022-36546 | High | 8.8 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settings.php. |
CVE-2022-31773 | High | 8.8 | 2022-08-26 | IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2021-39394 | Medium | 6.5 | 2022-08-26 | mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add user accounts and modify user informatio… |
CVE-2022-36358 | Medium | 5.4 | 2022-08-25 | Cross-Site Request Forgery (CSRF) vulnerability in SEO Scout plugin <= 0.9.83 at WordPress allows attackers to trick users with administrative rights to uninte… |
CVE-2018-14519 | Medium | 4.3 | 2022-08-24 | An issue was discovered in Kirby 2.5.12. The delete page functionality suffers from a CSRF flaw. A remote attacker can craft a malicious CSRF page and force th… |
CVE-2022-36389 | Medium | 4.3 | 2022-08-23 | Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress. |
CVE-2022-36379 | High | 8.8 | 2022-08-23 | Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. |
CVE-2022-36292 | Medium | 5.4 | 2022-08-23 | Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. |
CVE-2022-36288 | Medium | 5.4 | 2022-08-23 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
CVE-2022-29468 | High | 8.8 | 2022-08-22 | A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to incre… |
CVE-2022-36346 | Medium | 4.3 | 2022-08-22 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress. |
CVE-2022-35656 | Medium | 4.5 | 2022-08-22 | Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly. |
CVE-2022-34347 | Medium | 4.2 | 2022-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
CVE-2022-2555 | Medium | 6.5 | 2022-08-22 | The Yotpo Reviews for WooCommerce WordPress plugin through 2.0.4 lacks nonce check when updating its settings, which could allow attacker to make a logged in a… |
CVE-2022-2389 | Medium | 4.3 | 2022-08-22 | The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not hav… |
CVE-2022-2388 | Medium | 6.5 | 2022-08-22 | The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a lo… |
CVE-2022-2382 | Medium | 4.3 | 2022-08-22 | The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authen… |
CVE-2022-2377 | Medium | 4.3 | 2022-08-22 | The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary… |
CVE-2022-2375 | Medium | 5.4 | 2022-08-22 | The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to upda… |
CVE-2022-2312 | Medium | 5.4 | 2022-08-22 | The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make logged in user with a… |
CVE-2022-2276 | Medium | 4.3 | 2022-08-22 | The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete ar… |
CVE-2022-2275 | Medium | 4.3 | 2022-08-22 | The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin delete arbitrary pos… |
CVE-2022-2172 | Medium | 4.3 | 2022-08-22 | The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change settings via a CSRF a… |
CVE-2022-1251 | Medium | 4.3 | 2022-08-22 | The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a u… |
CVE-2021-36852 | Medium | 4.3 | 2022-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress. |
CVE-2021-24912 | Medium | 5.4 | 2022-08-22 | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to ma… |
CVE-2022-36579 | High | 8.8 | 2022-08-19 | Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2022-36577 | High | 8.8 | 2022-08-19 | An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin. |
CVE-2022-36225 | High | 8.8 | 2022-08-19 | EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management function and add. |
CVE-2022-36224 | High | 8.8 | 2022-08-19 | XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2022-23765 | High | 8.0 | 2022-08-17 | This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers… |
CVE-2022-2846 | Medium | 4.3 | 2022-08-16 | The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacki… |
CVE-2022-36312 | High | 8.8 | 2022-08-16 | Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and A… |
CVE-2022-38359 | High | 8.8 | 2022-08-15 | Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections. An attacker can… |
CVE-2022-2381 | High | 8.8 | 2022-08-15 | The E Unlocked - Student Result WordPress plugin through 1.0.4 is lacking CSRF and validation when uploading the School logo, which could allow attackers to ma… |
CVE-2022-35943 | Medium | 5.9 | 2022-08-12 | Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name… |
CVE-2022-37043 | Medium | 5.7 | 2022-08-12 | An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some PO… |
CVE-2022-2355 | Medium | 6.5 | 2022-08-08 | The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's… |
CVE-2022-33201 | Medium | 6.3 | 2022-08-05 | Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key. |
CVE-2021-36861 | Medium | 5.4 | 2022-08-05 | Cross-Site Request Forgery (CSRF) vulnerability in Rich Reviews by Starfish plugin <= 1.9.14 at WordPress allows an attacker to delete reviews. |
CVE-2016-3098 | Medium | 5.4 | 2022-08-05 | Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code. |
CVE-2022-34158 | High | 8.8 | 2022-08-04 | A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege esc… |
CVE-2022-28731 | Medium | 6.5 | 2022-08-04 | A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modif… |
CVE-2022-34937 | High | 8.8 | 2022-08-03 | Yuba u5cms v8.3.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component savepage.php. This vulnerability allows attackers to execute… |
CVE-2022-36968 | Medium | 4.3 | 2022-08-02 | In Progress WS_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to mitigate the risk of cross-site request… |
CVE-2022-34161 | High | 8.8 | 2022-08-01 | IBM CICS TX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a use… |
CVE-2022-2260 | Medium | 6.5 | 2022-08-01 | The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which… |
CVE-2022-2245 | High | 8.8 | 2022-08-01 | The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in… |
CVE-2022-2184 | High | 8.8 | 2022-08-01 | The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by att… |
CVE-2022-2171 | Medium | 5.4 | 2022-08-01 | The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admi… |
CVE-2022-26309 | Low | 3.7 | 2022-08-01 | Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group. |
CVE-2022-36920 | High | 8.8 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using… |
CVE-2022-36916 | High | 8.0 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup. |
CVE-2022-36911 | Medium | 6.5 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-36908 | Medium | 6.5 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an atta… |
CVE-2022-36906 | Medium | 6.5 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an attacker-specified U… |
CVE-2022-36887 | Medium | 4.3 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entr… |
CVE-2022-36886 | Medium | 4.3 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of… |
CVE-2022-36882 | High | 8.8 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an atta… |