CWE-352 · Cross-Site Request Forgery (CSRF) (page 61)
Page 61 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1092 | Medium | 4.3 | 2022-04-25 | The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticate… |
CVE-2022-0634 | Medium | 4.3 | 2022-04-25 | The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a r… |
CVE-2022-0398 | Medium | 5.4 | 2022-04-25 | The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which co… |
CVE-2022-0363 | Medium | 4.3 | 2022-04-25 | The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenti… |
CVE-2021-24805 | Medium | 4.3 | 2022-04-25 | The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in use… |
CVE-2022-27340 | High | 8.8 | 2022-04-22 | MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify d… |
CVE-2021-38886 | High | 8.8 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… |
CVE-2021-32929 | Medium | 4.3 | 2022-04-22 | All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user. |
CVE-2022-20787 | Medium | 5.7 | 2022-04-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edi… |
CVE-2022-27629 | High | 8.8 | 2022-04-20 | Cross-site request forgery (CSRF) vulnerability in 'MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6 allows a… |
CVE-2021-4096 | High | 8.8 | 2022-04-19 | The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers… |
CVE-2022-28108 | High | 8.8 | 2022-04-19 | Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/… |
CVE-2022-1112 | Medium | 5.4 | 2022-04-18 | The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not sanitise as well as escape them, which… |
CVE-2022-1020 | Critical | 9.8 | 2022-04-18 | The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_op… |
CVE-2022-0707 | Medium | 4.3 | 2022-04-18 | The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a… |
CVE-2022-23976 | High | 8.1 | 2022-04-18 | Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media). |
CVE-2022-23975 | Medium | 6.5 | 2022-04-18 | Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin. |
CVE-2022-27851 | Medium | 5.4 | 2022-04-15 | Cross-Site Request Forgery (CSRF) in Use Any Font (WordPress plugin) <= 6.1.7 allows an attacker to deactivate the API key. |
CVE-2022-27850 | Medium | 5.4 | 2022-04-15 | Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat message. |
CVE-2022-28109 | High | 8.8 | 2022-04-15 | Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. The impact is: execute arbitrary code (remot… |
CVE-2022-20735 | Medium | 6.5 | 2022-04-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site… |
CVE-2022-27847 | Medium | 4.3 | 2022-04-13 | Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to import templates. |
CVE-2022-27846 | Medium | 4.3 | 2022-04-13 | Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to create or modify slider. |
CVE-2022-22959 | Medium | 4.3 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user th… |
CVE-2022-26589 | Medium | 6.5 | 2022-04-13 | A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages. |
CVE-2022-29050 | High | 8.8 | 2022-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attack… |
CVE-2022-29048 | Medium | 4.3 | 2022-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2021-36914 | Medium | 6.1 | 2022-04-12 | Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) in CalderaWP License Manager (WordPress plugin) <= 1.2.11. |
CVE-2022-0141 | High | 8.1 | 2022-04-12 | The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and… |
CVE-2022-25754 | High | 8.8 | 2022-04-12 | A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coa… |
CVE-2022-25615 | Medium | 4.3 | 2022-04-11 | Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion. |
CVE-2022-25614 | Medium | 4.3 | 2022-04-11 | Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.7 allows an attacker to Sync with Zoom Meetings. |
CVE-2022-0914 | Medium | 6.5 | 2022-04-11 | The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export a… |
CVE-2021-32162 | High | 8.8 | 2022-04-11 | A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature. |
CVE-2021-32159 | High | 8.8 | 2022-04-11 | A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature. |
CVE-2021-32156 | High | 8.8 | 2022-04-11 | A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature. |
CVE-2022-26588 | Medium | 6.5 | 2022-04-08 | A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/service.php URI. |
CVE-2022-26180 | High | 8.8 | 2022-04-08 | qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI. |
CVE-2020-4668 | High | 8.8 | 2022-04-08 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.3, and 6.1.1.0 is vulnerable to cross-site request forgery which co… |
CVE-2022-20774 | Medium | 6.8 | 2022-04-06 | A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated… |
CVE-2021-41245 | Medium | 6.5 | 2022-04-05 | Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFile` aren't properly… |
CVE-2022-0830 | Medium | 6.5 | 2022-04-04 | The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as es… |
CVE-2022-0088 | High | 7.4 | 2022-04-03 | Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3. |
CVE-2021-44312 | High | 8.8 | 2022-03-30 | An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted w… |
CVE-2022-27432 | High | 8.8 | 2022-03-30 | A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to accoun… |
CVE-2022-28152 | Medium | 4.3 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore the default ownership… |
CVE-2022-28150 | High | 8.8 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change the owners and item-sp… |
CVE-2022-28143 | Medium | 6.5 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-specified host using a… |
CVE-2022-28138 | Medium | 4.3 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified… |
CVE-2022-28136 | High | 8.8 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to connect to an atta… |
CVE-2022-0427 | High | 7.7 | 2022-03-28 | Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP PO… |
CVE-2022-0833 | Medium | 4.3 | 2022-03-28 | The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticate… |
CVE-2022-0770 | High | 8.8 | 2022-03-28 | The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a… |
CVE-2022-0499 | High | 8.8 | 2022-03-28 | The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allo… |
CVE-2021-24978 | Medium | 5.3 | 2022-03-28 | The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv… |
CVE-2022-25523 | High | 8.8 | 2022-03-25 | TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request. |
CVE-2021-46426 | Medium | 6.1 | 2022-03-25 | phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality. |
CVE-2022-25576 | Medium | 4.5 | 2022-03-24 | Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers… |
CVE-2022-25268 | High | 8.8 | 2022-03-23 | Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems. |
CVE-2022-25608 | Medium | 5.4 | 2022-03-23 | Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to trick authenticated users into unwanted sl… |
CVE-2021-43737 | Medium | 6.5 | 2022-03-23 | An issus was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can modify administrator account's password. |
CVE-2021-43738 | High | 8.8 | 2022-03-23 | An issue was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can that can add the administrator account. |
CVE-2021-40662 | High | 8.8 | 2022-03-21 | A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interaction with a crafted U… |
CVE-2022-23349 | High | 8.8 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to contain a Cross-Site Request Forgery (CSRF). |
CVE-2022-0681 | Medium | 6.5 | 2022-03-21 | The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged… |
CVE-2022-0616 | Medium | 4.3 | 2022-03-21 | The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin dele… |
CVE-2022-0515 | Medium | 4.3 | 2022-03-21 | Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4. |
CVE-2022-0229 | High | 8.1 | 2022-03-21 | The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and d… |
CVE-2021-24905 | High | 8.0 | 2022-03-21 | The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and d… |
CVE-2022-24235 | High | 8.8 | 2022-03-21 | A Cross-Site Request Forgery (CSRF) in the management portal of Snapt Aria v12.8 allows attackers to escalate privileges and execute arbitrary code via unspeci… |
CVE-2022-27226 | High | 8.8 | 2022-03-19 | A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The c… |
CVE-2022-27214 | Medium | 4.3 | 2022-03-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL u… |
CVE-2022-27210 | Medium | 6.5 | 2022-03-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-s… |
CVE-2022-27204 | High | 8.8 | 2022-03-15 | A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to connect to an attacke… |
CVE-2022-27198 | High | 8.0 | 2022-03-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read… |
CVE-2022-22348 | Low | 2.4 | 2022-03-14 | IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked to from within Opera… |
CVE-2022-22346 | High | 8.8 | 2022-03-14 | IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malici… |
CVE-2021-45886 | High | 8.8 | 2022-03-13 | An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version… |
CVE-2022-25600 | Medium | 5.4 | 2022-03-11 | Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3… |
CVE-2022-0445 | Medium | 6.5 | 2022-03-07 | The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its s… |
CVE-2022-0439 | High | 8.8 | 2022-03-07 | The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list… |
CVE-2021-25098 | Medium | 6.5 | 2022-03-07 | The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to make a logged in ad… |
CVE-2020-18326 | High | 8.8 | 2022-03-04 | Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unaut… |
CVE-2021-44321 | Medium | 5.0 | 2022-03-04 | Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery (CSRF), where an attacker can update/delete items in the inventory. The at… |
CVE-2022-23052 | Medium | 6.5 | 2022-03-03 | PeteReport Version 0.5 contains a Cross Site Request Forgery (CSRF) vulnerability allowing an attacker to trick users into deleting users, products, reports an… |
CVE-2022-24712 | Medium | 6.3 | 2022-02-28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypas… |
CVE-2022-0345 | Medium | 4.3 | 2022-02-28 | The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowi… |
CVE-2022-0328 | Medium | 4.7 | 2022-02-28 | The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in adm… |
CVE-2021-25081 | Medium | 6.5 | 2022-02-28 | The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make… |
CVE-2021-25011 | Medium | 5.7 | 2022-02-28 | The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow… |
CVE-2021-25010 | Critical | 9.6 | 2022-02-28 | The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary sni… |
CVE-2021-24913 | Medium | 4.3 | 2022-02-28 | The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to… |
CVE-2021-24823 | High | 8.1 | 2022-02-28 | The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to m… |
CVE-2021-24803 | High | 8.8 | 2022-02-28 | The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin… |
CVE-2021-24730 | Medium | 4.3 | 2022-02-28 | The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, al… |
CVE-2021-24704 | High | 8.8 | 2022-02-28 | In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an u… |
CVE-2021-24688 | Medium | 4.3 | 2022-02-28 | The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one wh… |
CVE-2022-24342 | High | 8.8 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible. |
CVE-2022-24947 | High | 8.8 | 2022-02-25 | Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later. |
CVE-2022-21179 | Medium | 4.3 | 2022-02-24 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1… |