CWE-352 · Cross-Site Request Forgery (CSRF) (page 64)
Page 64 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-36505 | Medium | 6.5 | 2021-11-01 | The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an unauthenticated attac… |
CVE-2020-36504 | Medium | 6.5 | 2021-11-01 | The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make a logged in admin d… |
CVE-2015-10001 | Medium | 4.3 | 2021-11-01 | The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing att… |
CVE-2021-3901 | High | 8.8 | 2021-10-27 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3900 | Medium | 6.5 | 2021-10-27 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-41176 | Medium | 4.3 | 2021-10-25 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a… |
CVE-2021-24884 | Critical | 9.6 | 2021-10-25 | The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an u… |
CVE-2021-24779 | Medium | 6.5 | 2021-10-25 | The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a… |
CVE-2021-24543 | Medium | 6.1 | 2021-10-25 | The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and… |
CVE-2021-24487 | High | 8.8 | 2021-10-25 | The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also… |
CVE-2021-20120 | High | 8.8 | 2021-10-21 | The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. This means that an attacker c… |
CVE-2021-39126 | Medium | 6.5 | 2021-10-21 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerabi… |
CVE-2021-34743 | Medium | 4.3 | 2021-10-21 | A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external applica… |
CVE-2021-42097 | High | 8.0 | 2021-10-21 | GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value wi… |
CVE-2021-21745 | Medium | 4.3 | 2021-10-20 | ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal aut… |
CVE-2021-3858 | High | 8.8 | 2021-10-19 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-38480 | Critical | 9.6 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to cross-site request forgery when unauthorized commands are submitted from… |
CVE-2021-24752 | Medium | 5.7 | 2021-10-18 | Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users… |
CVE-2021-24735 | Medium | 6.5 | 2021-10-18 | The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Di… |
CVE-2021-24675 | Medium | 6.5 | 2021-10-18 | The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a r… |
CVE-2021-24642 | Medium | 6.5 | 2021-10-18 | The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation… |
CVE-2021-24615 | Medium | 5.4 | 2021-10-18 | The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logge… |
CVE-2021-24595 | Medium | 6.5 | 2021-10-18 | The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputting them in attribute… |
CVE-2021-39864 | Medium | 6.5 | 2021-10-15 | Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability… |
CVE-2021-42228 | High | 8.8 | 2021-10-14 | A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html. |
CVE-2020-19964 | Medium | 6.5 | 2021-10-14 | A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new administrator account without authenti… |
CVE-2021-20126 | High | 8.8 | 2021-10-13 | Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed, valid, consistent request wa… |
CVE-2021-20831 | High | 8.8 | 2021-10-13 | Cross-site request forgery (CSRF) vulnerability in OG Tags versions prior to 2.0.2 allows a remote attacker to hijack the authentication of administrators and… |
CVE-2021-20795 | High | 8.8 | 2021-10-13 | Cross-site request forgery (CSRF) vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to hijack the authent… |
CVE-2021-24711 | High | 8.8 | 2021-10-11 | The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF… |
CVE-2021-24683 | Medium | 5.4 | 2021-10-11 | The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which cou… |
CVE-2021-41916 | High | 8.8 | 2021-10-08 | A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add… |
CVE-2021-20489 | High | 8.8 | 2021-10-07 | IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2020-21658 | Medium | 6.5 | 2021-10-06 | A Cross-Site Request Forgery (CSRF) in WDJA CMS v1.5.2 allows attackers to arbitrarily add administrator accounts via a crafted URL. |
CVE-2021-29837 | High | 8.8 | 2021-10-06 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malic… |
CVE-2021-41113 | High | 8.8 | 2021-10-05 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 feature that allows u… |
CVE-2021-35491 | High | 8.1 | 2021-10-05 | A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginem… |
CVE-2020-21386 | High | 8.8 | 2021-10-04 | A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges. |
CVE-2021-36850 | Medium | 5.4 | 2021-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress Media File Renamer – Auto & Manual Rename plugin (versions <= 5.1.9). Affected parameters "post_ti… |
CVE-2021-41295 | High | 8.8 | 2021-09-30 | ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and… |
CVE-2021-41764 | High | 8.8 | 2021-09-29 | A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when perfor… |
CVE-2021-34636 | High | 8.8 | 2021-09-28 | The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/inc… |
CVE-2020-20693 | High | 8.8 | 2021-09-27 | A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts. |
CVE-2021-36877 | Medium | 4.3 | 2021-09-27 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify user roles. |
CVE-2021-36876 | Medium | 5.4 | 2021-09-27 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pa… |
CVE-2021-36878 | Medium | 4.3 | 2021-09-27 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to update settings. |
CVE-2021-40108 | High | 8.8 | 2021-09-27 | An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccm_token is not verified on the ccm/calendar/dialogs/event/add/save… |
CVE-2021-3819 | High | 8.8 | 2021-09-27 | firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-31604 | Medium | 6.5 | 2021-09-27 | furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client. |
CVE-2020-20514 | High | 8.1 | 2021-09-24 | A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users. |
CVE-2020-19951 | High | 8.8 | 2021-09-23 | A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application. |
CVE-2021-29816 | Medium | 6.5 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site request forgery which could allow an attacker to execut… |
CVE-2021-22953 | Medium | 5.4 | 2021-09-23 | A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for d… |
CVE-2021-22950 | Medium | 6.5 | 2021-09-23 | Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar Se… |
CVE-2021-22949 | Medium | 5.4 | 2021-09-23 | A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to duplicate files which can lead to UI inconvenience, and exhaustion of disk space.Credit fo… |
CVE-2021-41083 | High | 8.0 | 2021-09-20 | Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via email, SMS, etc, t… |
CVE-2021-24639 | High | 8.1 | 2021-09-20 | The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any… |
CVE-2021-24636 | High | 8.1 | 2021-09-20 | The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrators deactivate the Pr… |
CVE-2021-24618 | Medium | 5.4 | 2021-09-20 | The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS… |
CVE-2021-24584 | Medium | 5.4 | 2021-09-20 | The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_po… |
CVE-2021-24583 | Medium | 4.3 | 2021-09-20 | The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_po… |
CVE-2020-21321 | Medium | 4.3 | 2021-09-15 | emlog v6.0 contains a Cross-Site Request Forgery (CSRF) via /admin/link.php?action=addlink, which allows attackers to arbitrarily add articles. |
CVE-2021-40965 | High | 8.8 | 2021-09-15 | A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run… |
CVE-2020-21126 | High | 8.8 | 2021-09-15 | MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo. |
CVE-2021-39209 | High | 8.8 | 2021-09-15 | GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSR… |
CVE-2020-19159 | High | 8.8 | 2021-09-15 | Cross Site Request Forgery (CSRF) in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'. |
CVE-2021-23026 | High | 8.8 | 2021-09-14 | BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all vers… |
CVE-2020-21081 | Medium | 6.5 | 2021-09-14 | A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL. |
CVE-2021-23050 | High | 7.5 | 2021-09-14 | On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-… |
CVE-2021-37201 | High | 8.8 | 2021-09-14 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). The web interface of affected devices is vulnerable to a Cross-Site Request Forgery… |
CVE-2021-39124 | Medium | 4.3 | 2021-09-14 | The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attackers who are able… |
CVE-2020-20671 | High | 8.8 | 2021-09-13 | A cross-site request forgery (CSRF) in KiteCMS V1.1 allows attackers to arbitrarily add an administrator account. |
CVE-2021-24725 | Medium | 4.3 | 2021-09-13 | The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attac… |
CVE-2021-24620 | High | 8.8 | 2021-09-13 | The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital pro… |
CVE-2021-24586 | Medium | 4.3 | 2021-09-13 | The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admi… |
CVE-2021-24491 | High | 8.8 | 2021-09-13 | The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a result, attackers… |
CVE-2021-24490 | Medium | 6.8 | 2021-09-13 | The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary fil… |
CVE-2021-24431 | Medium | 4.3 | 2021-09-13 | The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generat… |
CVE-2020-19280 | High | 8.8 | 2021-09-09 | Jeesns 1.4.2 contains a cross-site request forgery (CSRF) which allows attackers to escalate privileges and perform sensitive program operations. |
CVE-2020-19268 | Medium | 5.7 | 2021-09-09 | A cross-site request forgery (CSRF) in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to arbitrarily add administrator users. |
CVE-2020-19264 | Medium | 6.5 | 2021-09-09 | A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily add users via index.php?s=/user/ApiAdminUser/itemAdd. |
CVE-2020-19263 | High | 8.8 | 2021-09-09 | A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily escalate user privileges to administrator via index.php?s=/user/ApiAdminUs… |
CVE-2021-38721 | Medium | 6.5 | 2021-09-09 | FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability |
CVE-2021-23404 | High | 7.6 | 2021-09-08 | This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated… |
CVE-2021-38705 | High | 8.8 | 2021-09-07 | ClinicCases 7.3.3 is affected by Cross-Site Request Forgery (CSRF). A successful attack would consist of an authenticated user following a malicious link, resu… |
CVE-2021-39197 | Medium | 6.3 | 2021-09-07 | better_errors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any… |
CVE-2021-37725 | High | 8.1 | 2021-09-07 | A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prio… |
CVE-2019-5318 | Medium | 6.5 | 2021-09-07 | A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba Operating System Software version(s): 6.x.x.x: all versions, 8.x.x.x: all vers… |
CVE-2021-24611 | Medium | 5.4 | 2021-09-06 | The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing f… |
CVE-2020-20343 | Medium | 6.5 | 2021-09-01 | WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add_post component that allows attackers to arbitrarily a… |
CVE-2021-21679 | High | 8.8 | 2021-08-31 | Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. |
CVE-2021-21678 | High | 8.8 | 2021-08-31 | Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. |
CVE-2020-19047 | High | 8.8 | 2021-08-31 | Cross Site Request Forgey (CSRF) in iWebShop v5.3 allows remote atatckers to execute arbitrary code via malicious POST request to the component '/index.php?con… |
CVE-2021-27557 | Medium | 4.3 | 2021-08-31 | A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job. |
CVE-2021-39133 | High | 7.2 | 2021-08-30 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin… |
CVE-2021-38342 | High | 8.1 | 2021-08-30 | The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which a… |
CVE-2021-32991 | Medium | 4.3 | 2021-08-30 | Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a user to carry out an a… |
CVE-2020-18124 | Medium | 5.7 | 2021-08-30 | A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily reset account passwords. |
CVE-2020-18123 | Medium | 6.5 | 2021-08-30 | A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts. |
CVE-2021-24581 | High | 8.8 | 2021-08-30 | The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Si… |