CWE-352 · Cross-Site Request Forgery (CSRF) (page 68)
Page 68 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7332 | High | 7.0 | 2020-11-12 | Cross Site Request Forgery vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows an attacke… |
CVE-2019-7357 | High | 8.8 | 2020-11-10 | Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins. |
CVE-2020-27146 | Medium | 5.0 | 2020-11-10 | The Core component of TIBCO Software Inc.'s TIBCO iProcess Workspace (Browser) contains a vulnerability that theoretically allows an unauthenticated attacker w… |
CVE-2020-27016 | High | 8.8 | 2020-11-09 | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability which could allow an… |
CVE-2020-4651 | Medium | 4.8 | 2020-11-09 | IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute… |
CVE-2020-15259 | High | 8.1 | 2020-11-06 | ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidentia… |
CVE-2020-27692 | High | 8.8 | 2020-11-04 | The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers ca… |
CVE-2020-22273 | Medium | 6.5 | 2020-11-04 | Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed (such as Payment Settings) |
CVE-2020-2303 | Medium | 4.3 | 2020-11-04 | A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting… |
CVE-2020-28040 | Medium | 4.3 | 2020-11-02 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. |
CVE-2020-11485 | High | 8.8 | 2020-10-29 | NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery (CSRF) vulnerability in the AMI BMC firmware i… |
CVE-2020-16256 | High | 8.8 | 2020-10-28 | The API on Winston 1.5.4 devices is vulnerable to CSRF. |
CVE-2020-27975 | High | 8.8 | 2020-10-28 | osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF. |
CVE-2020-24847 | Medium | 4.3 | 2020-10-23 | A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthen… |
CVE-2020-18129 | High | 8.8 | 2020-10-22 | A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php. |
CVE-2020-24033 | High | 8.8 | 2020-10-22 | An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote… |
CVE-2020-3456 | High | 8.8 | 2020-10-21 | A vulnerability in the Cisco Firepower Chassis Manager (FCM) of Cisco FXOS Software could allow an unauthenticated, remote attacker to conduct a cross-site req… |
CVE-2020-5790 | Medium | 6.5 | 2020-10-20 | Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a cr… |
CVE-2020-12502 | High | 8.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-5642 | High | 8.8 | 2020-10-15 | Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of a… |
CVE-2020-4773 | Medium | 6.5 | 2020-10-12 | A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that forces a user to exe… |
CVE-2020-26912 | High | 7.5 | 2020-10-09 | Certain NETGEAR devices are affected by CSRF. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1.0.1.24, R6020 before 1.0.0.42, R6050… |
CVE-2020-26522 | High | 8.8 | 2020-10-09 | A cross-site request forgery (CSRF) vulnerability in mod/user/act_user.php in Garfield Petshop through 2020-10-01 allows remote attackers to hijack the authent… |
CVE-2020-26802 | High | 8.8 | 2020-10-08 | forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET request to change the… |
CVE-2020-2296 | Medium | 4.3 | 2020-10-08 | A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objects. |
CVE-2020-2295 | Medium | 6.5 | 2020-10-08 | A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascade builds and layout… |
CVE-2020-25263 | High | 7.1 | 2020-10-08 | PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI: an arbitrary plugin will be deleted. |
CVE-2020-25262 | Medium | 4.3 | 2020-10-08 | PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted. |
CVE-2020-25986 | Medium | 6.5 | 2020-10-06 | A Cross Site Request Forgery (CSRF) vulnerability in MonoCMS Blog 1.0 allows attackers to change the password of a user. |
CVE-2020-12123 | High | 8.1 | 2020-10-02 | CSRF vulnerabilities in the /cgi-bin/ directory of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to remotely access router endpoints, because these… |
CVE-2020-5786 | High | 8.8 | 2020-10-01 | Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a remote attacker to perform sensitive application actions by tricking legitimate use… |
CVE-2020-24570 | Medium | 6.5 | 2020-09-30 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue (with resultant SSRF) in the com_mb24proxy module… |
CVE-2020-13658 | High | 8.0 | 2020-09-30 | In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the ap… |
CVE-2020-25142 | Medium | 6.5 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable if any links and forms lack an unpredictable CSRF token… |
CVE-2020-23837 | High | 8.8 | 2020-09-25 | A Cross-Site Request Forgery (CSRF) vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin (or other) users after… |
CVE-2020-12841 | Medium | 6.5 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload imae files via /index.php |
CVE-2020-12840 | Medium | 6.5 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload sound files via /index.php |
CVE-2020-12282 | High | 8.8 | 2020-09-24 | iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php. (This can be combined w… |
CVE-2020-12281 | Medium | 6.5 | 2020-09-24 | iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php. |
CVE-2020-12280 | Medium | 6.5 | 2020-09-24 | iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to open/close a specified garage door/gate via /isg/opendoor.php. |
CVE-2020-5783 | Medium | 5.4 | 2020-09-23 | In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms. |
CVE-2020-2281 | Medium | 5.4 | 2020-09-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserve, unlock, and rese… |
CVE-2020-2280 | High | 8.8 | 2020-09-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code. |
CVE-2020-3135 | High | 8.8 | 2020-09-23 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (UCM) could allow an unauthenticated, remote attacker to conduct… |
CVE-2020-3124 | Medium | 6.5 | 2020-09-23 | A vulnerability in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) could allow an unauthenticated, remote attacker to condu… |
CVE-2019-16009 | High | 8.8 | 2020-09-23 | A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (C… |
CVE-2020-14025 | High | 8.8 | 2020-09-22 | Ozeki NG SMS Gateway through 4.17.6 has multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted… |
CVE-2020-4617 | High | 8.1 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tran… |
CVE-2020-14506 | Low | 3.4 | 2020-09-18 | Philips Clinical Collaboration Platform, Versions 12.2.1 and prior. The product receives input or data, but it does not validate or incorrectly validates that… |
CVE-2020-15182 | High | 8.4 | 2020-09-17 | The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE). The vulnerability affects versions 2.0.0… |
CVE-2020-24373 | High | 8.8 | 2020-09-16 | A CSRF vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3. |
CVE-2020-13259 | High | 8.8 | 2020-09-16 | A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauthenticated, remote attacker to conduct a… |
CVE-2020-25015 | Medium | 6.5 | 2020-09-16 | A specific router allows changing the Wi-Fi password remotely. Genexis Platinum 4410 V2-1.28, a compact router generally used at homes and offices was found to… |
CVE-2020-2273 | Medium | 4.3 | 2020-09-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an attacker-specified URL using a… |
CVE-2020-2268 | High | 8.8 | 2020-09-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary f… |
CVE-2020-25453 | High | 8.8 | 2020-09-15 | An issue was discovered in BlackCat CMS before 1.4. There is a CSRF vulnerability (bypass csrf_token) that allows remote arbitrary code execution. |
CVE-2020-4526 | Medium | 4.3 | 2020-09-15 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized act… |
CVE-2020-23451 | High | 8.8 | 2020-09-15 | Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function. |
CVE-2020-10229 | High | 8.8 | 2020-09-14 | A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an administrator's behalf, such as uploading files, adding users, and de… |
CVE-2020-23824 | High | 8.8 | 2020-09-11 | ArGo Soft Mail Server 1.8.8.9 is affected by Cross Site Request Forgery (CSRF) for perform remote arbitrary code execution. The component is the Administration… |
CVE-2018-19948 | Low | 2.0 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerability could allow att… |
CVE-2020-25252 | High | 8.8 | 2020-09-11 | An issue was discovered in Hyland OnBase through 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and be… |
CVE-2020-24739 | Medium | 6.5 | 2020-09-10 | A CSRF vulnerability was found in iCMS v7.0.0 in the background deletion administrator account. When missing the CSRF_TOKEN and can still request normally, all… |
CVE-2020-15789 | High | 8.1 | 2020-09-09 | A vulnerability has been identified in Polarion Subversion Webclient (All versions). The web interface could allow a Cross-Site Request Forgery (CSRF) attack i… |
CVE-2020-23830 | High | 7.1 | 2020-09-02 | A Cross-Site Request Forgery (CSRF) vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future l… |
CVE-2020-5776 | High | 8.8 | 2020-09-01 | Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is levera… |
CVE-2020-25070 | High | 8.8 | 2020-09-01 | USVN (aka User-friendly SVN) before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature. |
CVE-2020-16208 | High | 8.8 | 2020-09-01 | The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a device by luring an authe… |
CVE-2020-23836 | High | 8.8 | 2020-09-01 | A Cross-Site Request Forgery (CSRF) vulnerability in edit_user.php in OSWAPP Warehouse Inventory System (aka OSWA-INV) through 2020-08-10 allows remote attacke… |
CVE-2020-2241 | High | 8.8 | 2020-09-01 | A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-specified database serv… |
CVE-2020-2240 | High | 8.8 | 2020-09-01 | A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to execute arbitrary SQL scripts. |
CVE-2020-16610 | Medium | 4.3 | 2020-08-28 | Hoosk Codeigniter CMS before 1.7.2 is affected by a Cross Site Request Forgery (CSRF). When an attacker induces authenticated admin user to a malicious web pag… |
CVE-2020-5621 | Medium | 4.3 | 2020-08-28 | Cross-site request forgery (CSRF) vulnerability in NETGEAR switching hubs (GS716Tv2 Firmware version 5.4.2.30 and earlier, and GS724Tv3 Firmware version 5.4.2… |
CVE-2020-15156 | Medium | 6.8 | 2020-08-26 | In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on… |
CVE-2020-5928 | Low | 3.1 | 2020-08-26 | In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, BIG-IP ASM Configuration utility CSRF pro… |
CVE-2020-5922 | High | 8.8 | 2020-08-26 | In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request… |
CVE-2020-4170 | Medium | 4.3 | 2020-08-24 | IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tr… |
CVE-2020-14043 | High | 8.8 | 2020-08-24 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later. The request to download a plu… |
CVE-2020-19889 | High | 8.8 | 2020-08-24 | DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for index.php?dbhcms_pid=-70 can add a user. |
CVE-2020-19886 | High | 8.1 | 2020-08-24 | DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for an /index.php?dbhcms_pid=-80&deletemenu=9 can delete any menu. |
CVE-2020-15151 | High | 8.0 | 2020-08-20 | OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface… |
CVE-2020-12480 | Medium | 6.5 | 2020-08-17 | In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be… |
CVE-2016-11085 | Medium | 6.5 | 2020-08-16 | php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name param… |
CVE-2020-7304 | High | 7.6 | 2020-08-13 | Cross site request forgery vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote attacker to embed a CRS… |
CVE-2020-2237 | Medium | 4.3 | 2020-08-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Flaky Test Handler Plugin 1.0.4 and earlier allows attackers to rebuild a project at a previous gi… |
CVE-2020-2235 | Medium | 6.5 | 2020-08-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-spe… |
CVE-2020-7029 | Medium | 6.4 | 2020-08-11 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya… |
CVE-2020-12781 | Medium | 5.7 | 2020-08-10 | Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery. |
CVE-2020-16253 | High | 8.1 | 2020-08-05 | The PgHero gem through 2.6.0 for Ruby allows CSRF. |
CVE-2020-16252 | Medium | 4.3 | 2020-08-05 | The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF. |
CVE-2020-15135 | Medium | 6.7 | 2020-08-04 | save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version… |
CVE-2020-5615 | High | 8.8 | 2020-08-04 | Cross-site request forgery (CSRF) vulnerability in [Calendar01] free edition ver1.0.0 and [Calendar02] free edition ver1.0.0 allows remote attackers to hijack… |
CVE-2020-5770 | High | 8.8 | 2020-08-03 | Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.01 allows a remote attacker to perform sensitive application actions by tricking legitimate us… |
CVE-2020-14319 | Medium | 5.9 | 2020-08-03 | It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight checks are not inst… |
CVE-2020-10984 | High | 8.8 | 2020-07-28 | Gambio GX before 4.0.1.0 allows admin/admin.php CSRF. |
CVE-2020-5611 | High | 8.8 | 2020-07-27 | Cross-site request forgery (CSRF) vulnerability in Social Sharing Plugin versions prior to 1.2.10 allows remote attackers to hijack the authentication of admin… |
CVE-2020-15882 | High | 8.1 | 2020-07-23 | A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines from the MunkiReport database. |
CVE-2020-5767 | Medium | 6.5 | 2020-07-17 | Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking le… |
CVE-2020-11438 | High | 8.8 | 2020-07-15 | LibreHealth EMR v2.0.0 is affected by systemic CSRF. |
CVE-2020-15700 | Medium | 6.3 | 2020-07-15 | An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoint of com_installer causes a CSRF vulnerability. |