CWE-352 · Cross-Site Request Forgery (CSRF) (page 62)
Page 62 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4030 | High | 8.0 | 2022-02-24 | A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they c… |
CVE-2022-25599 | Medium | 5.4 | 2022-02-21 | Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0). |
CVE-2022-23983 | Medium | 4.3 | 2022-02-21 | Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (v… |
CVE-2022-0313 | Medium | 4.3 | 2022-02-21 | The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete… |
CVE-2022-0199 | Medium | 4.3 | 2022-02-21 | The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to mak… |
CVE-2022-0164 | Medium | 4.3 | 2022-02-21 | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowi… |
CVE-2022-0134 | High | 8.8 | 2022-02-21 | The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in a… |
CVE-2021-45007 | Medium | 6.5 | 2022-02-20 | Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel. NOTE: the ve… |
CVE-2022-0638 | Medium | 4.3 | 2022-02-17 | Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-25242 | High | 8.8 | 2022-02-16 | In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF). |
CVE-2022-25241 | High | 8.8 | 2022-02-16 | In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF). |
CVE-2021-46252 | Medium | 6.5 | 2022-02-15 | A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requirem… |
CVE-2022-25212 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers to connect to an attacker-specified web server usi… |
CVE-2022-25207 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an a… |
CVE-2022-25205 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database vi… |
CVE-2022-25200 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attacker-specified webserv… |
CVE-2022-25198 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attacker-specified SSH serv… |
CVE-2022-25194 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-specified URL server… |
CVE-2022-25192 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 1.10 and earlier allows attackers to connect to an attacker-specified webser… |
CVE-2022-23384 | High | 8.8 | 2022-02-15 | YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add |
CVE-2021-43941 | Medium | 6.5 | 2022-02-15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and Importer… |
CVE-2021-43953 | Medium | 4.3 | 2022-02-15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings v… |
CVE-2021-43952 | Medium | 4.3 | 2022-02-15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Si… |
CVE-2021-24446 | Medium | 5.4 | 2022-02-14 | The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in… |
CVE-2021-46366 | High | 8.8 | 2022-02-11 | An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSR… |
CVE-2020-13674 | Medium | 6.5 | 2022-02-11 | The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible da… |
CVE-2020-13673 | Medium | 6.1 | 2022-02-11 | The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user… |
CVE-2022-22811 | High | 8.1 | 2022-02-09 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could induce users to perform unintended actions, leading to the override of the system�… |
CVE-2022-22808 | High | 8.8 | 2022-02-09 | A CWE-352: Cross-Site Request Forgery (CSRF) exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain… |
CVE-2021-22954 | High | 8.8 | 2022-02-09 | A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users. |
CVE-2022-21703 | Medium | 6.3 | 2022-02-08 | Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows a… |
CVE-2021-45326 | High | 8.8 | 2022-02-08 | Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests. |
CVE-2022-0505 | Medium | 6.5 | 2022-02-08 | Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11. |
CVE-2021-25108 | High | 7.1 | 2022-02-07 | The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing att… |
CVE-2021-25095 | High | 7.1 | 2022-02-07 | The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX a… |
CVE-2021-24993 | Medium | 6.5 | 2022-02-07 | The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticat… |
CVE-2021-24947 | Medium | 6.5 | 2022-02-07 | The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_i… |
CVE-2021-24879 | High | 8.8 | 2022-02-07 | The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the fi… |
CVE-2021-24843 | Medium | 6.5 | 2022-02-07 | The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin… |
CVE-2021-32732 | High | 7.5 | 2022-02-04 | ### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by… |
CVE-2020-7534 | High | 8.8 | 2022-02-04 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on… |
CVE-2021-46398 | High | 8.8 | 2022-02-04 | A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access t… |
CVE-2021-45268 | High | 8.8 | 2022-02-03 | A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting… |
CVE-2021-39044 | High | 8.8 | 2022-02-02 | IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2022-23601 | High | 8.1 | 2022-02-01 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechani… |
CVE-2021-25097 | Medium | 6.5 | 2022-02-01 | The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated use… |
CVE-2021-25092 | Medium | 6.5 | 2022-02-01 | The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged in admin reset arb… |
CVE-2021-25072 | Medium | 6.5 | 2022-02-01 | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a… |
CVE-2021-24763 | High | 8.8 | 2022-02-01 | The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, allowing unauthenti… |
CVE-2021-24761 | Medium | 6.5 | 2022-02-01 | The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which cou… |
CVE-2022-23888 | High | 8.8 | 2022-01-28 | YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html. |
CVE-2022-23887 | Medium | 6.5 | 2022-01-28 | YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/de… |
CVE-2021-22725 | High | 8.8 | 2022-01-28 | A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when… |
CVE-2021-22724 | High | 8.8 | 2022-01-28 | A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when… |
CVE-2021-44122 | High | 8.8 | 2022-01-26 | SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire… |
CVE-2022-0335 | High | 8.8 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionali… |
CVE-2022-0269 | High | 8.0 | 2022-01-24 | Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0. |
CVE-2021-25073 | High | 8.8 | 2022-01-24 | The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in ad… |
CVE-2021-25013 | Medium | 6.5 | 2022-01-24 | The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the… |
CVE-2021-24989 | Medium | 6.5 | 2022-01-24 | The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the… |
CVE-2021-24968 | Medium | 5.7 | 2022-01-24 | The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX… |
CVE-2021-24936 | High | 8.0 | 2022-01-24 | The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allo… |
CVE-2021-24696 | High | 8.8 | 2022-01-24 | The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins… |
CVE-2021-46028 | Medium | 4.3 | 2022-01-20 | In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a mali… |
CVE-2021-46027 | Medium | 6.5 | 2022-01-19 | mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The attacker constructs a CSRF load. Once the administrator clicks a… |
CVE-2021-44777 | Medium | 5.4 | 2022-01-19 | Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5… |
CVE-2022-0215 | High | 8.8 | 2022-01-18 | The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-S… |
CVE-2022-0154 | High | 7.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions st… |
CVE-2021-43353 | High | 8.8 | 2022-01-18 | The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function fo… |
CVE-2022-0245 | Medium | 4.3 | 2022-01-18 | Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0. |
CVE-2021-4164 | High | 8.8 | 2022-01-17 | calibre-web is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-25025 | Medium | 4.3 | 2022-01-17 | The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with… |
CVE-2022-0180 | High | 8.8 | 2022-01-17 | Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of admi… |
CVE-2022-0238 | Medium | 4.3 | 2022-01-16 | phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-0226 | Medium | 4.3 | 2022-01-14 | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-0231 | Medium | 6.5 | 2022-01-14 | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-23227 | Medium | 5.4 | 2022-01-13 | Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions. |
CVE-2022-0197 | High | 8.8 | 2022-01-13 | phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-0196 | High | 8.8 | 2022-01-13 | phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-23115 | Medium | 5.4 | 2022-01-12 | Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, bui… |
CVE-2022-23111 | Medium | 4.3 | 2022-01-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attacker-specified SSH… |
CVE-2022-20619 | High | 7.1 | 2022-01-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an att… |
CVE-2022-20613 | Medium | 4.3 | 2022-01-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS used by the Jenkins… |
CVE-2022-20612 | Medium | 4.3 | 2022-01-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parame… |
CVE-2021-41597 | High | 8.8 | 2022-01-12 | SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP a… |
CVE-2021-37198 | High | 8.8 | 2022-01-11 | A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components… |
CVE-2021-25053 | High | 8.8 | 2022-01-10 | The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:/… |
CVE-2021-25052 | High | 8.8 | 2022-01-10 | The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as wit… |
CVE-2021-25051 | High | 8.8 | 2022-01-10 | The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with da… |
CVE-2021-25032 | Critical | 9.8 | 2022-01-10 | The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF c… |
CVE-2021-46147 | High | 8.8 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF. |
CVE-2021-34086 | High | 8.8 | 2022-01-10 | In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs v… |
CVE-2021-46080 | Medium | 4.8 | 2022-01-06 | A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0. An successful CSRF attacks leads to Stored Cross Site Script… |
CVE-2021-20165 | High | 8.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. Most pages lack proper usage of CSRF protections or mitigations. Addit… |
CVE-2020-29292 | Medium | 6.5 | 2021-12-30 | iBall WRD12EN 1.0.0 devices allow cross-site request forgery (CSRF) attacks as demonstrated by enabling DNS settings or modifying the range for IP addresses. |
CVE-2020-21236 | High | 8.8 | 2021-12-27 | A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a use… |
CVE-2020-20945 | High | 8.8 | 2021-12-27 | A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts. |
CVE-2020-20943 | Medium | 4.3 | 2021-12-27 | A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing… |
CVE-2021-24988 | Medium | 5.4 | 2021-12-27 | The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lea… |
CVE-2021-4168 | High | 8.8 | 2021-12-26 | showdoc is vulnerable to Cross-Site Request Forgery (CSRF) |