CWE-352 · Cross-Site Request Forgery (CSRF) (page 66)
Page 66 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-18265 | High | 8.8 | 2021-06-07 | Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/a… |
CVE-2020-18264 | High | 8.8 | 2021-06-07 | Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/a… |
CVE-2020-36140 | Medium | 6.5 | 2021-06-04 | BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change an… |
CVE-2020-35972 | Medium | 4.3 | 2021-06-03 | An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html. |
CVE-2020-10771 | High | 7.1 | 2021-06-02 | A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an… |
CVE-2021-24333 | Medium | 6.5 | 2021-06-01 | The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and… |
CVE-2021-24328 | Medium | 6.2 | 2021-06-01 | The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. Th… |
CVE-2020-26641 | High | 8.8 | 2021-05-28 | A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute arbitrary web scripts. |
CVE-2019-14836 | High | 8.8 | 2021-05-26 | A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An attacker could use this flaw to access un… |
CVE-2021-26034 | Medium | 6.5 | 2021-05-26 | An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sy… |
CVE-2021-26033 | Medium | 6.5 | 2021-05-26 | An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint. |
CVE-2021-20096 | High | 8.1 | 2021-05-25 | Cross-site request forgery in OpenOversight 0.6.4 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking… |
CVE-2020-25411 | Medium | 6.5 | 2021-05-24 | Projectworlds Online Examination System 1.0 is vulnerable to CSRF, which allows a remote attacker to delete the existing user. |
CVE-2020-25408 | Medium | 6.5 | 2021-05-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in ProjectWorlds College Management System Php 1.0 that allows a remote attacker to modify, delete, or… |
CVE-2021-21549 | High | 8.8 | 2021-05-21 | Dell EMC XtremIO Versions prior to 6.3.3-8, contain a Cross-Site Request Forgery Vulnerability in XMS. A non-privileged attacker could potentially exploit this… |
CVE-2021-32632 | Low | 2.4 | 2021-05-20 | Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery (CSRF). Hosters of the bot should upgrade to `v1.52` or… |
CVE-2021-25931 | High | 8.8 | 2021-05-20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… |
CVE-2021-25930 | Medium | 4.3 | 2021-05-20 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… |
CVE-2021-29624 | Medium | 6.5 | 2021-05-19 | fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "doubl… |
CVE-2020-24740 | Medium | 4.3 | 2021-05-18 | An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via a /admin.php?action=editpage |
CVE-2020-18198 | High | 8.8 | 2021-05-17 | Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.p… |
CVE-2020-18195 | High | 8.8 | 2021-05-17 | Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admi… |
CVE-2021-24324 | Medium | 6.5 | 2021-05-17 | The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user change the plugin'… |
CVE-2021-32403 | High | 8.8 | 2021-05-17 | Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mechanisms for token protection and unsafe i… |
CVE-2021-32402 | High | 8.8 | 2021-05-17 | Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurations in inputs and… |
CVE-2021-32073 | High | 8.8 | 2021-05-15 | DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution. |
CVE-2020-18964 | High | 8.8 | 2021-05-11 | Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote malicious gain pri… |
CVE-2021-21655 | High | 7.1 | 2021-05-11 | A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server… |
CVE-2021-21652 | High | 7.1 | 2021-05-11 | A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacke… |
CVE-2020-23376 | Medium | 6.1 | 2021-05-10 | NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrar… |
CVE-2020-19199 | High | 8.8 | 2021-05-10 | A Cross Site Request Forgery (CSRF) vulnerability exists in PHPOK 5.2.060 via admin.php?c=admin&f=save, which could let a remote malicious user execute arbitra… |
CVE-2021-32096 | High | 8.8 | 2021-05-07 | The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an ev… |
CVE-2020-23264 | High | 8.8 | 2021-05-06 | Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators. |
CVE-2020-18889 | Medium | 6.5 | 2021-05-06 | Cross Site Request Forgery (CSRF) vulnerability in puppyCMS v5.1 that can change the admin's password via /admin/settings.php. |
CVE-2021-24251 | Medium | 4.3 | 2021-05-06 | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowin… |
CVE-2021-24249 | Medium | 6.5 | 2021-05-06 | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowin… |
CVE-2021-24179 | High | 8.8 | 2021-05-06 | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forgery issue, allowing… |
CVE-2021-24178 | High | 8.8 | 2021-05-06 | The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forgery issues, allowing… |
CVE-2020-23127 | High | 8.8 | 2021-05-06 | Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user. |
CVE-2021-24272 | Medium | 4.3 | 2021-05-05 | The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check… |
CVE-2020-36334 | High | 8.8 | 2021-05-05 | themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database. |
CVE-2021-29238 | High | 8.8 | 2021-05-03 | CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF). |
CVE-2021-30224 | High | 8.8 | 2021-04-29 | Cross Site Request Forgery (CSRF) in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials. |
CVE-2021-28280 | Medium | 6.1 | 2021-04-29 | CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML |
CVE-2020-22000 | High | 8.0 | 2021-04-27 | HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulne… |
CVE-2020-21989 | High | 8.8 | 2021-04-27 | HomeAutomation 3.3.2 is affected by Cross Site Request Forgery (CSRF). The application interface allows users to perform certain actions via HTTP requests with… |
CVE-2021-31762 | High | 8.8 | 2021-04-25 | Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell thro… |
CVE-2021-31760 | High | 8.8 | 2021-04-25 | Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature. |
CVE-2021-31584 | High | 8.8 | 2021-04-23 | Sipwise C5 NGCP www_csc version 3.6.4 up to and including platform NGCP CE mr3.8.13 allows call/click2dial CSRF attacks for actions with administrative privile… |
CVE-2021-21644 | Medium | 5.4 | 2021-04-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corre… |
CVE-2021-27181 | High | 8.8 | 2021-04-14 | An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit th… |
CVE-2021-31152 | High | 8.8 | 2021-04-14 | Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can enable remote access, change passwords, an… |
CVE-2021-29436 | Medium | 5.4 | 2021-04-13 | Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forg… |
CVE-2021-29435 | High | 8.1 | 2021-04-13 | trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create… |
CVE-2021-21731 | High | 8.1 | 2021-04-13 | A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully verify whether the r… |
CVE-2021-21729 | Medium | 6.5 | 2021-04-13 | Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by… |
CVE-2021-29054 | High | 8.8 | 2021-04-13 | Certain Papoo products are affected by: Cross Site Request Forgery (CSRF) in the admin interface. This affects Papoo CMS Light through 21.02 and Papoo CMS Pro… |
CVE-2021-24231 | Medium | 6.5 | 2021-04-12 | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged a… |
CVE-2021-24230 | High | 8.1 | 2021-04-12 | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged i… |
CVE-2021-24218 | High | 8.8 | 2021-04-12 | The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a l… |
CVE-2021-25327 | Medium | 6.5 | 2021-04-09 | Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery (CSRF) vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter… |
CVE-2021-25326 | Medium | 5.4 | 2021-04-09 | Skyworth Digital Technology RN510 V.3.1.0.4 is affected by an incorrect access control vulnerability in/cgi-bin/test_version.asp. If Wi-Fi is connected but an… |
CVE-2020-21884 | High | 8.8 | 2021-04-09 | Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace… |
CVE-2021-22512 | Medium | 6.5 | 2021-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and… |
CVE-2020-23426 | Critical | 9.8 | 2021-04-08 | zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further at… |
CVE-2021-30114 | Medium | 6.5 | 2021-04-08 | Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a voucher payment request through modul… |
CVE-2021-30112 | Medium | 6.5 | 2021-04-08 | Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a student_leave_application request thr… |
CVE-2021-21641 | Medium | 4.3 | 2021-04-07 | A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds. |
CVE-2021-20687 | High | 8.8 | 2021-04-07 | Cross-site request forgery (CSRF) vulnerability in Kagemai 0.8.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors. |
CVE-2021-30147 | High | 8.8 | 2021-04-07 | DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php. |
CVE-2021-24174 | High | 8.1 | 2021-04-05 | The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate… |
CVE-2021-24173 | Medium | 6.1 | 2021-04-05 | The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as update the plugin'… |
CVE-2021-24172 | Medium | 4.3 | 2021-04-05 | The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups o… |
CVE-2021-24166 | Medium | 5.4 | 2021-04-05 | The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce pr… |
CVE-2021-24162 | High | 8.8 | 2021-04-05 | In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings… |
CVE-2021-24161 | High | 8.8 | 2021-04-05 | In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive co… |
CVE-2021-24159 | High | 8.8 | 2021-04-05 | Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a s… |
CVE-2021-29660 | High | 8.8 | 2021-04-02 | A Cross-Site Request Forgery (CSRF) vulnerability in en/cfg_setpwd.html in Softing AG OPC Toolbox through 4.10.1.13035 allows attackers to reset the administra… |
CVE-2021-22202 | Low | 2.4 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks throug… |
CVE-2021-25924 | High | 8.8 | 2021-04-01 | In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An atta… |
CVE-2021-26071 | Low | 3.5 | 2021-04-01 | The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 bef… |
CVE-2021-29349 | Medium | 6.5 | 2021-03-31 | Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. The application fails to valida… |
CVE-2021-21638 | High | 8.8 | 2021-03-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-speci… |
CVE-2021-21633 | High | 8.8 | 2021-03-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specifi… |
CVE-2021-21629 | High | 8.8 | 2021-03-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-spe… |
CVE-2020-19639 | High | 8.8 | 2021-03-30 | Cross Site Request Forgery (CSRF) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI. |
CVE-2020-36283 | Critical | 9.6 | 2021-03-24 | HID OMNIKEY 5427 and OMNIKEY 5127 readers are vulnerable to CSRF when using the EEM driver (Ethernet Emulation Mode). By persuading an authenticated user to vi… |
CVE-2021-26216 | Medium | 4.3 | 2021-03-18 | SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php. |
CVE-2021-26215 | Medium | 4.3 | 2021-03-18 | SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. |
CVE-2021-24133 | Medium | 4.3 | 2021-03-18 | Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in adminis… |
CVE-2021-21627 | High | 8.8 | 2021-03-18 | A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains. |
CVE-2020-29553 | High | 8.8 | 2021-03-15 | The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF). |
CVE-2020-24982 | Medium | 4.3 | 2021-03-15 | An issue was discovered in Quadbase ExpressDashboard (EDAB) 7 Update 9. It allows CSRF. An attacker may be able to trick an authenticated user into changing th… |
CVE-2020-24984 | High | 8.8 | 2021-03-11 | An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user in… |
CVE-2020-24983 | High | 8.8 | 2021-03-11 | An issue was discovered in Quadbase EspressReports ES 7 Update 9. An unauthenticated attacker can create a malicious HTML file that houses a POST request made… |
CVE-2020-14989 | Medium | 6.5 | 2021-03-11 | An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows CSRF if the attacker uses GET where POST was intended. |
CVE-2020-35223 | High | 8.8 | 2021-03-10 | The CSRF protection mechanism implemented in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices could be bypassed by omitting the CSRF… |
CVE-2020-28705 | Medium | 4.3 | 2021-03-10 | FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3. |
CVE-2020-27574 | High | 8.8 | 2021-03-08 | Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF). If an authenticated user visits a malicious page, unintended actions could be… |
CVE-2020-29030 | High | 8.1 | 2021-03-05 | Cross-Site Request Forgery (CSRF) vulnerability in web GUI of Secomea GateManager allows an attacker to execute malicious code. This issue affects: Secomea Gat… |