CWE-352 · Cross-Site Request Forgery (CSRF) (page 59)
Page 59 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-35286 | High | 8.8 | 2022-07-26 | IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2022-22686 | Medium | 6.5 | 2022-07-26 | Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the auth… |
CVE-2022-35285 | High | 8.8 | 2022-07-25 | IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2021-40335 | Medium | 5.0 | 2022-07-25 | A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intention… |
CVE-2022-2071 | Medium | 6.1 | 2022-07-25 | The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some o… |
CVE-2022-29495 | Medium | 5.4 | 2022-07-22 | Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacker to update plugin settings. |
CVE-2022-30337 | Medium | 5.4 | 2022-07-21 | Cross-Site Request Forgery (CSRF) vulnerability in JoomUnited WP Meta SEO plugin <= 4.4.8 at WordPress allows an attacker to update the social settings. |
CVE-2022-32289 | Medium | 5.4 | 2022-07-21 | Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change. |
CVE-2022-34367 | Medium | 5.4 | 2022-07-21 | Dell EMC Data Protection Central versions 19.1, 19.2, 19.3, 19.4, 19.5, 19.6, contain(s) a Cross-Site Request Forgery Vulnerability. A(n) remote unauthenticate… |
CVE-2022-20861 | Critical | 9.8 | 2022-07-21 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image… |
CVE-2022-29454 | Low | 3.1 | 2022-07-20 | Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload files. File attachment… |
CVE-2022-22359 | Medium | 6.5 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute ma… |
CVE-2021-38868 | Medium | 6.5 | 2022-07-18 | IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site request forgery which could allow an attacker to execute… |
CVE-2022-2443 | High | 8.8 | 2022-07-18 | The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due to missing nonce pro… |
CVE-2022-2435 | High | 8.8 | 2022-07-18 | The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to missing nonce protecti… |
CVE-2022-2224 | Medium | 5.4 | 2022-07-18 | The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly… |
CVE-2022-2223 | Medium | 5.4 | 2022-07-18 | The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the… |
CVE-2022-2039 | High | 8.8 | 2022-07-18 | The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing non… |
CVE-2022-2001 | High | 8.8 | 2022-07-18 | The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce prot… |
CVE-2022-1912 | High | 8.8 | 2022-07-18 | The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing no… |
CVE-2022-32320 | High | 8.8 | 2022-07-17 | A Cross-Site Request Forgery (CSRF) in Ferdi through 5.8.1 and Ferdium through 6.0.0-nightly.98 allows attackers to read files via an uploaded file such as a s… |
CVE-2022-2146 | Medium | 6.1 | 2022-07-17 | The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check… |
CVE-2022-2144 | Medium | 4.3 | 2022-07-17 | The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which could allow attackers… |
CVE-2022-1672 | High | 8.8 | 2022-07-17 | The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which coul… |
CVE-2022-35228 | High | 8.8 | 2022-07-12 | SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be achi… |
CVE-2022-2123 | Medium | 4.3 | 2022-07-11 | The WP Opt-in WordPress plugin through 1.4.1 is vulnerable to CSRF which allows changed plugin settings and can be used for sending spam emails. |
CVE-2022-2091 | Medium | 6.5 | 2022-07-11 | The Cache Images WordPress plugin before 3.2.1 does not implement nonce checks, which could allow attackers to make any logged user upload images via a CSRF at… |
CVE-2022-1957 | Medium | 4.3 | 2022-07-11 | The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2022-1956 | Medium | 4.3 | 2022-07-11 | The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authent… |
CVE-2022-1757 | Medium | 5.4 | 2022-07-11 | The pagebar WordPress plugin before 2.70 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin ch… |
CVE-2022-1732 | Medium | 6.5 | 2022-07-11 | The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to mak… |
CVE-2022-1626 | Medium | 5.4 | 2022-07-11 | The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin… |
CVE-2022-1599 | Medium | 6.5 | 2022-07-11 | The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users wit… |
CVE-2022-1576 | Medium | 6.5 | 2022-07-11 | The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to mak… |
CVE-2022-2353 | Medium | 6.1 | 2022-07-09 | Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch cont… |
CVE-2015-1785 | Medium | 6.5 | 2022-07-07 | In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The… |
CVE-2021-31679 | Medium | 6.5 | 2022-07-06 | An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that allows attackers to delete admin and other members' account numbers. |
CVE-2021-31678 | Medium | 6.5 | 2022-07-06 | An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can delete import information about a user's company. |
CVE-2021-31677 | Medium | 6.5 | 2022-07-06 | An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can modify admin and other members' passwords. |
CVE-2021-23163 | Low | 3.1 | 2022-07-06 | JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects: JFrog JF… |
CVE-2022-1967 | Medium | 6.5 | 2022-07-04 | The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions… |
CVE-2022-34817 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs. |
CVE-2022-34815 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, the… |
CVE-2022-34812 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath ex… |
CVE-2022-34797 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specifie… |
CVE-2022-34792 | High | 8.0 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified UR… |
CVE-2022-34789 | Medium | 6.5 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds. |
CVE-2022-34780 | Medium | 6.5 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specifie… |
CVE-2017-20120 | Medium | 4.3 | 2022-06-29 | A vulnerability classified as problematic was found in TrueConf Server 4.3.7. This vulnerability affects unknown code of the file /admin/service/stop/. The man… |
CVE-2022-31886 | Medium | 6.5 | 2022-06-28 | Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). An attacker can disable the 2FA by sending the user a malicious form. |
CVE-2022-34134 | High | 8.8 | 2022-06-28 | Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php. |
CVE-2022-1960 | Medium | 4.3 | 2022-06-27 | The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin chan… |
CVE-2022-1914 | Medium | 4.3 | 2022-06-27 | The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2022-1913 | Medium | 4.3 | 2022-06-27 | The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2022-1885 | Medium | 4.3 | 2022-06-27 | The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make… |
CVE-2022-1847 | Medium | 4.3 | 2022-06-27 | The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2022-1846 | Medium | 4.3 | 2022-06-27 | The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2022-1845 | Medium | 4.3 | 2022-06-27 | The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete pl… |
CVE-2022-1844 | Medium | 4.3 | 2022-06-27 | The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin… |
CVE-2022-1843 | Medium | 6.5 | 2022-06-27 | The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the sett… |
CVE-2022-1842 | Medium | 4.3 | 2022-06-27 | The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logge… |
CVE-2022-1653 | Medium | 4.3 | 2022-06-27 | The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker t… |
CVE-2022-1627 | Medium | 4.3 | 2022-06-27 | The My Private Site WordPress plugin before 3.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2022-1625 | Medium | 4.3 | 2022-06-27 | The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow at… |
CVE-2022-1574 | Critical | 9.8 | 2022-06-27 | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthent… |
CVE-2022-1573 | Medium | 4.3 | 2022-06-27 | The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin… |
CVE-2022-1572 | High | 8.1 | 2022-06-27 | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscrib… |
CVE-2022-0875 | Medium | 4.3 | 2022-06-27 | The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowin… |
CVE-2022-0444 | Medium | 4.3 | 2022-06-27 | The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resettin… |
CVE-2022-33121 | High | 8.1 | 2022-06-24 | A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link. |
CVE-2017-20093 | Medium | 4.3 | 2022-06-24 | A vulnerability, which was classified as problematic, was found in Download Manager Plugin 2.8.99. Affected is an unknown function. The manipulation leads to c… |
CVE-2022-34211 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an a… |
CVE-2022-34209 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-34207 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-34205 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an att… |
CVE-2022-34203 | High | 8.8 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins EasyQA Plugin 1.0 and earlier allows attackers to connect to an attacker-specified HTTP server. |
CVE-2022-34200 | High | 8.8 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-speci… |
CVE-2017-20091 | Medium | 4.3 | 2022-06-23 | A vulnerability was found in File Manager Plugin 3.0.1. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross-si… |
CVE-2017-20090 | Medium | 4.3 | 2022-06-23 | A vulnerability was found in Global Content Blocks Plugin 2.1.5. It has been declared as problematic. This vulnerability affects unknown code. The manipulation… |
CVE-2017-20088 | Medium | 4.3 | 2022-06-23 | A vulnerability classified as problematic has been found in Atahualpa Theme. Affected is an unknown function. The manipulation leads to cross-site request forg… |
CVE-2017-20065 | Medium | 4.3 | 2022-06-20 | A vulnerability was found in Supsystic Popup Plugin 1.7.6 and classified as problematic. This issue affects some unknown processing. The manipulation leads to… |
CVE-2022-1895 | Medium | 4.3 | 2022-06-20 | The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to ma… |
CVE-2022-1832 | Medium | 6.5 | 2022-06-20 | The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2022-1831 | Medium | 6.5 | 2022-06-20 | The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin c… |
CVE-2022-1830 | Medium | 6.5 | 2022-06-20 | The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a… |
CVE-2022-1829 | Medium | 6.5 | 2022-06-20 | The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2022-1828 | Medium | 6.5 | 2022-06-20 | The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a lo… |
CVE-2022-1827 | Medium | 6.5 | 2022-06-20 | The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2022-1826 | Medium | 6.5 | 2022-06-20 | The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in… |
CVE-2022-1818 | Medium | 5.4 | 2022-06-20 | The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2022-1630 | Medium | 6.5 | 2022-06-20 | The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin dele… |
CVE-2022-1610 | Medium | 6.5 | 2022-06-20 | The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2022-1603 | Medium | 4.3 | 2022-06-20 | The Mail Subscribe List WordPress plugin before 2.1.4 does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a l… |
CVE-2017-20062 | Medium | 5.0 | 2022-06-20 | A vulnerability was found in Elefant CMS 1.3.12-RC and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-s… |
CVE-2022-30328 | Medium | 6.5 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The username and password setup for the web interface does not require entering the existi… |
CVE-2022-30327 | Medium | 6.5 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The web interface is vulnerable to CSRF. An attacker can change the pre-shared key of the… |
CVE-2022-26173 | High | 8.8 | 2022-06-16 | JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via http://target_host:port/jforum-2.8.0/jforum.page, which allows attackers to arb… |
CVE-2022-31294 | Medium | 6.5 | 2022-06-16 | An issue in the save_users() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts. |
CVE-2017-20053 | Medium | 4.3 | 2022-06-16 | A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been declared as problematic. Affected by this vulnerability is an unknown function… |
CVE-2021-36891 | Medium | 5.4 | 2022-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin <= 1.15.5 at WordPress allows changing the plugin settings. |