CWE-352 · Cross-Site Request Forgery (CSRF) (page 67)
Page 67 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-26961 | High | 8.8 | 2021-03-05 | A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A v… |
CVE-2021-26960 | High | 8.8 | 2021-03-05 | A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A v… |
CVE-2021-27927 | High | 8.8 | 2021-03-03 | In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpd… |
CVE-2021-27885 | High | 8.8 | 2021-03-02 | usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism. |
CVE-2021-1227 | High | 8.1 | 2021-02-24 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) at… |
CVE-2021-21620 | Medium | 4.3 | 2021-02-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims. |
CVE-2021-21617 | High | 8.8 | 2021-02-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Configuration Slicing Plugin 1.51 and earlier allows attackers to apply different slice configurat… |
CVE-2020-27997 | High | 8.8 | 2021-02-19 | An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery (CSRF) protection may lead to elevation of privileges (e.g., /admin/c… |
CVE-2021-22701 | Medium | 4.5 | 2021-02-19 | A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see not… |
CVE-2021-26296 | High | 7.5 | 2021-02-19 | In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically wea… |
CVE-2020-36247 | High | 8.8 | 2021-02-19 | Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF. |
CVE-2021-20073 | High | 8.8 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for cross-site request forgeries. |
CVE-2021-20650 | Medium | 6.5 | 2021-02-12 | Cross-site request forgery (CSRF) vulnerability in ELECOM NCC-EWF100RMWH2 allows remote attackers to hijack the authentication of administrators and execute an… |
CVE-2021-20647 | Medium | 6.5 | 2021-02-12 | Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-S allows remote attackers to hijack the authentication of administrators and execute an a… |
CVE-2021-20646 | Medium | 6.5 | 2021-02-12 | Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-A allows remote attackers to hijack the authentication of administrators and execute an a… |
CVE-2021-20641 | Medium | 6.5 | 2021-02-12 | Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/RS allows remote attackers to hijack the authentication of administrators via a specially… |
CVE-2021-20636 | Medium | 6.5 | 2021-02-12 | Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administrators via a speciall… |
CVE-2021-21027 | Medium | 4.3 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the… |
CVE-2020-13186 | Medium | 6.5 | 2021-02-11 | An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web form, which allowed an attacker with kno… |
CVE-2020-10734 | Low | 3.3 | 2021-02-11 | A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Sin… |
CVE-2021-20403 | High | 8.8 | 2021-02-11 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauth… |
CVE-2020-28644 | Medium | 4.3 | 2021-02-09 | The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie authenticated requests against some ocs API endpoints. This affects ownC… |
CVE-2020-35943 | Medium | 6.5 | 2021-02-09 | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protectio… |
CVE-2020-35942 | High | 8.8 | 2021-02-09 | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings mod… |
CVE-2020-13460 | High | 8.8 | 2021-02-09 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were present in Tufin SecureTrack, affecting all versions prior to R20-2 GA. |
CVE-2021-22500 | Medium | 6.5 | 2021-02-06 | Cross Site Request Forgery vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51. The vulnerability c… |
CVE-2021-20652 | High | 8.8 | 2021-02-05 | Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via… |
CVE-2020-4827 | Medium | 4.3 | 2021-02-04 | IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site request forgery which could allow an attacker to execu… |
CVE-2020-4826 | Medium | 4.3 | 2021-02-04 | IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site request forgery which could allow an attacker to execu… |
CVE-2020-9388 | Medium | 6.5 | 2021-02-03 | CSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an administrator executing arbitrary code in a HTM… |
CVE-2021-25765 | High | 8.8 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. |
CVE-2020-24271 | High | 8.8 | 2021-02-01 | A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/clo… |
CVE-2020-29004 | High | 8.8 | 2021-01-29 | The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack. |
CVE-2020-28403 | High | 8.0 | 2021-01-29 | A Cross-Site Request Forgery (CSRF) vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an attacker to change the privileges of a… |
CVE-2020-13569 | High | 8.8 | 2021-01-28 | A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f600ff1394f91ccd512bc… |
CVE-2021-20621 | High | 8.8 | 2021-01-28 | Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remot… |
CVE-2020-35239 | High | 8.8 | 2021-01-26 | A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks… |
CVE-2021-21275 | Medium | 5.3 | 2021-01-25 | The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Sp… |
CVE-2020-12511 | High | 8.8 | 2021-01-22 | Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface. |
CVE-2021-1257 | High | 8.8 | 2021-01-20 | A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site requ… |
CVE-2020-28452 | Medium | 6.3 | 2021-01-20 | This affects the package com.softwaremill.akka-http-session:core_2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core_… |
CVE-2020-35217 | High | 8.8 | 2021-01-20 | Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in… |
CVE-2020-23342 | High | 8.8 | 2021-01-19 | A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users. |
CVE-2020-23522 | Medium | 6.8 | 2021-01-19 | Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter. |
CVE-2020-6776 | High | 8.8 | 2021-01-14 | A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10… |
CVE-2020-35687 | Medium | 4.3 | 2021-01-13 | PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim. |
CVE-2020-36191 | Medium | 4.5 | 2021-01-13 | JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user ac… |
CVE-2021-3133 | Medium | 6.5 | 2021-01-12 | The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages. |
CVE-2021-21241 | High | 7.4 | 2021-01-11 | The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask… |
CVE-2020-23631 | Medium | 6.1 | 2021-01-11 | Cross-site request forgery (CSRF) in admin/global/manage.php in WDJA CMS 1.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via the tong… |
CVE-2020-23960 | High | 8.8 | 2021-01-11 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as… |
CVE-2020-35722 | Medium | 6.5 | 2021-01-11 | CSRF in Web Compliance Manager in Quest Policy Authority 8.1.2.200 allows remote attackers to force user modification/creation via a specially crafted link to… |
CVE-2020-25950 | Medium | 4.3 | 2021-01-08 | Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery (CSRF) attacks that can delete a contact from the My Additional Contact page. |
CVE-2020-36174 | Medium | 6.5 | 2021-01-06 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. |
CVE-2020-7336 | Medium | 6.6 | 2021-01-05 | Cross Site Request Forgery vulnerability in McAfee Network Security Management (NSM) prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to… |
CVE-2020-4942 | High | 8.8 | 2021-01-04 | IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unautho… |
CVE-2020-4917 | High | 8.8 | 2021-01-04 | IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted fr… |
CVE-2021-21495 | High | 8.8 | 2021-01-04 | MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar_central.php?acao=altsenha_princ URI. |
CVE-2020-35950 | Critical | 9.8 | 2021-01-01 | An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint). |
CVE-2020-35944 | High | 8.8 | 2021-01-01 | An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, which can lead to XSS. |
CVE-2018-16795 | High | 8.8 | 2020-12-31 | OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_files.php… |
CVE-2020-35778 | Medium | 4.3 | 2020-12-30 | Certain NETGEAR devices are affected by CSRF. This affects GS716Tv3 before 6.3.1.36 and GS724Tv4 before 6.3.1.36. |
CVE-2020-35773 | High | 8.8 | 2020-12-29 | The site-offline plugin before 1.4.4 for WordPress lacks certain wp_create_nonce and wp_verify_nonce calls, aka CSRF. |
CVE-2020-35615 | Medium | 6.3 | 2020-12-28 | An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of com_privacy causes a CSRF vulnerability. |
CVE-2020-26033 | Medium | 5.4 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and delete) lack a CSRF token check. |
CVE-2020-35347 | Medium | 6.5 | 2020-12-26 | CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add. |
CVE-2020-26766 | High | 8.8 | 2020-12-26 | A Cross Site Request Forgery (CSRF) vulnerability exists in the loginsystem page in PHPGurukul User Registration & Login and User Management System With Admin… |
CVE-2020-35677 | Medium | 4.8 | 2020-12-24 | BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to creat… |
CVE-2020-35269 | High | 8.8 | 2020-12-23 | Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or serve… |
CVE-2020-35626 | High | 8.8 | 2020-12-21 | An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1. The primary form did not implement an anti-CSRF token and therefore was comp… |
CVE-2020-35273 | High | 8.0 | 2020-12-21 | EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privileges in the User Pr… |
CVE-2020-7201 | High | 8.8 | 2020-12-18 | A potential security vulnerability has been identified in the HPE StoreEver MSL2024 Tape Library and HPE StoreEver 1/8 G2 Tape Autoloaders. The vulnerability c… |
CVE-2020-4764 | Medium | 6.5 | 2020-12-18 | IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2020-13527 | Medium | 4.5 | 2020-12-18 | An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. A speci… |
CVE-2020-8465 | Critical | 9.8 | 2020-12-17 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSR… |
CVE-2020-8461 | High | 8.8 | 2020-12-17 | A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a victim's browser to sen… |
CVE-2020-25095 | High | 8.8 | 2020-12-17 | LogRhythm Platform Manager (PM) 7.4.9 allows CSRF. The Web interface is vulnerable to Cross-site WebSocket Hijacking (CSWH). If a logged-in PM user visits a ma… |
CVE-2020-4904 | Medium | 6.5 | 2020-12-16 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 is vulnerable to cross-site request forgery which could allow an attacker to exec… |
CVE-2020-28931 | High | 8.8 | 2020-12-16 | Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to force an administra… |
CVE-2019-14481 | Medium | 5.4 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery (CSRF) vulnerability in the NetCrunch web client. Successful exploitation requires a logged-in use… |
CVE-2020-25622 | High | 8.8 | 2020-12-16 | An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF. |
CVE-2020-14368 | High | 7.1 | 2020-12-14 | A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't p… |
CVE-2019-19289 | High | 8.8 | 2020-12-14 | A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting us… |
CVE-2020-8282 | High | 8.8 | 2020-12-14 | A security issue was found in EdgePower 24V/54V firmware v1.7.0 and earlier where, due to missing CSRF protections, an attacker would have been able to perform… |
CVE-2020-28858 | High | 8.8 | 2020-12-14 | OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly verify whether a request made to the application was intentionally made by the user… |
CVE-2020-29254 | High | 8.8 | 2020-12-11 | TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forge… |
CVE-2020-28838 | Low | 3.5 | 2020-12-11 | Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart. |
CVE-2020-35135 | High | 8.8 | 2020-12-11 | The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF. |
CVE-2020-2321 | High | 8.1 | 2020-12-03 | A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or delete a project. |
CVE-2020-14369 | Medium | 6.3 | 2020-12-02 | This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web appli… |
CVE-2020-29458 | High | 8.8 | 2020-12-02 | Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem. |
CVE-2020-4127 | Medium | 6.5 | 2020-11-30 | HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into accessing a system under another ID or us… |
CVE-2020-17901 | Medium | 6.5 | 2020-11-30 | Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user. |
CVE-2020-7780 | Medium | 6.3 | 2020-11-27 | This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; th… |
CVE-2020-26936 | High | 8.8 | 2020-11-26 | Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack. |
CVE-2020-13620 | High | 8.8 | 2020-11-24 | Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's ability to perform adm… |
CVE-2020-25472 | Medium | 6.5 | 2020-11-24 | SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF) vulnerability, which allows attackers to add new users. |
CVE-2020-5641 | Medium | 6.5 | 2020-11-24 | Cross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier allows remote attackers to hijack the authentication of admini… |
CVE-2020-13350 | Low | 3.1 | 2020-11-17 | CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runne… |
CVE-2020-28649 | High | 8.8 | 2020-11-16 | The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file. |