CWE-352 · Cross-Site Request Forgery (CSRF) (page 69)
Page 69 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15695 | Medium | 6.3 | 2020-07-15 | An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerability. |
CVE-2019-12784 | High | 8.8 | 2020-07-14 | An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE… |
CVE-2020-6289 | High | 8.8 | 2020-07-14 | SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malic… |
CVE-2020-15711 | High | 8.8 | 2020-07-14 | In MISP before 2.4.129, setting a favourite homepage was not CSRF protected. |
CVE-2020-10986 | Medium | 6.5 | 2020-07-13 | A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of se… |
CVE-2020-15600 | Medium | 6.5 | 2020-07-07 | An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password. |
CVE-2020-15516 | Medium | 5.4 | 2020-07-07 | The mm_forum extension through 1.9.5 for TYPO3 allows XSS that can be exploited via CSRF. |
CVE-2020-8166 | Medium | 4.3 | 2020-07-02 | A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one presen… |
CVE-2020-2215 | Medium | 4.3 | 2020-07-02 | A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specifi… |
CVE-2020-2203 | Medium | 4.3 | 2020-07-02 | A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify… |
CVE-2020-5904 | High | 8.8 | 2020-07-01 | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic Managem… |
CVE-2020-5900 | High | 8.8 | 2020-07-01 | In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface. |
CVE-2020-15400 | Medium | 4.3 | 2020-06-30 | CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS. |
CVE-2019-20415 | Medium | 4.3 | 2020-06-30 | Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (C… |
CVE-2020-15043 | Medium | 6.5 | 2020-06-29 | iBall WRB303N devices allow CSRF attacks, as demonstrated by enabling remote management, enabling DHCP, or modifying the subnet range for IP addresses. |
CVE-2019-20411 | Medium | 4.3 | 2020-06-29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerab… |
CVE-2020-15046 | High | 8.8 | 2020-06-24 | The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF iss… |
CVE-2020-15014 | High | 8.8 | 2020-06-24 | pramodmahato BlogCMS through 2019-12-31 has admin/changepass.php CSRF. |
CVE-2020-13157 | Medium | 6.5 | 2020-06-23 | modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI. The old password is n… |
CVE-2020-13156 | Medium | 6.5 | 2020-06-23 | modules\users\admin\add_user.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=user_add URI. |
CVE-2020-13155 | High | 8.8 | 2020-06-23 | clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI. |
CVE-2020-13426 | Medium | 6.5 | 2020-06-22 | The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents, allowing the possibility of dele… |
CVE-2020-14203 | High | 8.8 | 2020-06-22 | WebFOCUS Business Intelligence 8.0 (SP6) allows a Cross-Site Request Forgery (CSRF) attack against administrative users within the /ibi_apps/WFServlet(.ibfs) e… |
CVE-2019-20891 | High | 8.8 | 2020-06-19 | WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XS… |
CVE-2016-11084 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. |
CVE-2017-18903 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled. |
CVE-2020-8167 | Medium | 6.5 | 2020-06-19 | A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains. |
CVE-2019-20865 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF. |
CVE-2019-20841 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account take… |
CVE-2020-14432 | High | 8.8 | 2020-06-18 | Certain NETGEAR devices are affected by CSRF. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25… |
CVE-2020-7503 | High | 8.8 | 2020-06-16 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to execute m… |
CVE-2019-19109 | High | 8.8 | 2020-06-15 | The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF. |
CVE-2020-4040 | High | 8.6 | 2020-06-08 | Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief… |
CVE-2020-9042 | High | 8.8 | 2020-06-08 | In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results o… |
CVE-2020-13868 | Medium | 6.5 | 2020-06-05 | An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity. |
CVE-2020-11682 | Medium | 6.5 | 2020-06-04 | Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by the web interface, and included in reques… |
CVE-2020-13786 | High | 8.8 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF. |
CVE-2020-2196 | High | 8.0 | 2020-06-03 | Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided b… |
CVE-2020-2192 | Medium | 6.5 | 2020-06-03 | A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent lab… |
CVE-2020-13760 | High | 8.8 | 2020-06-02 | In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF. |
CVE-2014-8942 | High | 8.8 | 2020-06-01 | Lexiglot through 2014-11-20 allows CSRF. |
CVE-2020-4018 | High | 8.8 | 2020-06-01 | The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forge… |
CVE-2020-13643 | High | 8.8 | 2020-05-28 | An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing… |
CVE-2020-13642 | High | 8.8 | 2020-05-28 | An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verificati… |
CVE-2020-13641 | High | 8.8 | 2020-05-28 | An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, a… |
CVE-2020-8168 | High | 8.8 | 2020-05-26 | We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prio… |
CVE-2020-13458 | High | 8.8 | 2020-05-25 | An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action. |
CVE-2020-13416 | Medium | 6.5 | 2020-05-22 | An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens… |
CVE-2020-13412 | High | 8.8 | 2020-05-22 | An issue was discovered in Aviatrix Controller before 5.4.1204. An API call on the web interface lacked a session token check to control access, leading to CSR… |
CVE-2020-1103 | Medium | 6.5 | 2020-05-21 | An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search at… |
CVE-2019-20804 | High | 8.8 | 2020-05-21 | Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading to compromise of the admin account. |
CVE-2020-13231 | Medium | 6.5 | 2020-05-20 | In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change. |
CVE-2020-4286 | Medium | 6.5 | 2020-05-19 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unaut… |
CVE-2020-12257 | High | 8.8 | 2020-05-18 | rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation of CSRF protection such as a CSRF token. An attacker can lever… |
CVE-2019-20390 | High | 8.1 | 2020-05-15 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a vic… |
CVE-2020-5576 | High | 8.8 | 2020-05-14 | Cross-site request forgery (CSRF) vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4… |
CVE-2020-11069 | High | 8.0 | 2020-05-14 | In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-s… |
CVE-2020-12427 | High | 8.8 | 2020-05-13 | The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, mo… |
CVE-2020-11060 | High | 7.4 | 2020-05-12 | In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an att… |
CVE-2020-5745 | High | 7.4 | 2020-05-07 | Cross-site request forgery in TCExam 14.2.2 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a craf… |
CVE-2020-2186 | Medium | 4.3 | 2020-05-06 | A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances. |
CVE-2020-2184 | Medium | 4.3 | 2020-05-06 | A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker… |
CVE-2020-8830 | High | 8.8 | 2020-05-05 | CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wir… |
CVE-2020-8829 | High | 8.8 | 2020-05-05 | CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis. |
CVE-2020-7983 | High | 8.1 | 2020-05-05 | A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks. |
CVE-2020-5517 | Medium | 6.5 | 2020-05-05 | CSRF in the /login URI in BlueOnyx 5209R allows an attacker to access the dashboard and perform scraping or other analysis. |
CVE-2019-19517 | High | 8.8 | 2020-05-05 | Intelbras RF1200 1.1.3 devices allow CSRF to bypass the login.html form, as demonstrated by launching a scrapy process. |
CVE-2020-5335 | Medium | 5.0 | 2020-05-04 | RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability. A remote unauthenticated attacker could potentially exploit… |
CVE-2020-12626 | Medium | 6.5 | 2020-05-04 | An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered. |
CVE-2019-0235 | High | 8.8 | 2020-04-30 | Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks. |
CVE-2020-12462 | Medium | 6.1 | 2020-04-29 | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS. |
CVE-2017-18861 | High | 8.0 | 2020-04-28 | Certain NETGEAR devices are affected by CSRF. This affects ReadyNAS Surveillance 1.4.3-15-x86 and earlier and ReadyNAS Surveillance 1.1.4-5-ARM and earlier. |
CVE-2016-11055 | Medium | 4.3 | 2020-04-28 | Certain NETGEAR devices are affected by CSRF. This affects CM400 before 2017-01-11, CM600 before 2017-01-11, D1500 before 2017-01-11, D500 before 2017-01-11, D… |
CVE-2018-21096 | High | 7.4 | 2020-04-27 | Certain NETGEAR devices are affected by CSRF. This affects WAC120 before 2.1.7, WAC505 before 5.0.5.4, WAC510 before 5.0.5.4, WNAP320 before 3.7.11.4, WNAP210v… |
CVE-2019-4750 | High | 8.8 | 2020-04-24 | IBM Cloud App Management 2019.3.0 and 2019.4.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… |
CVE-2017-18703 | High | 8.8 | 2020-04-24 | Certain NETGEAR devices are affected by CSRF. This affects D1500 before 1.0.0.25, D500 before 1.0.0.25, D6100 before 1.0.0.55, D7000 before 1.0.1.50, D7800 bef… |
CVE-2017-18708 | High | 8.8 | 2020-04-24 | Certain NETGEAR devices are affected by CSRF. This affects R8300 before 1.0.2.94 and R8500 before 1.0.2.94. |
CVE-2018-21160 | High | 8.8 | 2020-04-23 | NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF. |
CVE-2018-21102 | High | 8.8 | 2020-04-23 | NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF. |
CVE-2017-18749 | High | 8.8 | 2020-04-23 | Certain NETGEAR devices are affected by CSRF. This affects JNR1010v2 before 1.1.0.44, JR6150 before 1.0.1.10, JWNR2010v5 before 1.1.0.44, R6050 before 1.0.1.10… |
CVE-2017-18742 | High | 8.8 | 2020-04-23 | Certain NETGEAR devices are affected by CSRF. This affects JR6150 before 1.0.1.10, R6050 before 1.0.1.10, R6250 before 1.0.4.12, R6300v2 before 1.0.4.8, R6700… |
CVE-2020-12076 | High | 8.8 | 2020-04-23 | The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS. |
CVE-2020-10892 | High | 8.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to… |
CVE-2020-10890 | High | 8.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to… |
CVE-2017-18755 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by CSRF. This affects R6300v2 before 1.0.4.8, R6400v2 before 1.0.2.32, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000… |
CVE-2018-21120 | High | 8.0 | 2020-04-22 | Certain NETGEAR devices are affected by CSRF. This affects WAC120 before 2.1.7, WAC505 before 5.0.5.4, WAC510 before 5.0.5.4, WNAP320 before 3.7.11.4, WNAP210v… |
CVE-2017-18768 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by CSRF. This affects EX6100 before 1.0.2.16_1.1.130, EX6100v2 before 1.0.1.70, EX6150v2 before 1.0.1.54, EX6200v2 before… |
CVE-2017-18782 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by CSRF. This affects D6200 before 1.1.00.24, D7000 before 1.0.1.52, JR6150 before 1.0.1.12, JNR1010v2 before 1.1.0.44, JW… |
CVE-2017-18781 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by CSRF. This affects D6200 before 1.1.00.24, D7000 before 1.0.1.52, JNR1010v2 before 1.1.0.44, JWNR2010v5 before 1.1.0.44… |
CVE-2017-18775 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by CSRF. This affects R6100 before 1.0.1.12, R7500 before 1.0.0.108, WNDR3700v4 before 1.0.2.86, WNDR4300v1 before 1.0.2.8… |
CVE-2017-18791 | High | 8.8 | 2020-04-21 | Certain NETGEAR devices are affected by CSRF. This affects R6050/JR6150 before 1.0.1.7, PR2000 before 1.0.0.17, R6220 before 1.1.0.50, WNDR3700v5 before 1.1.0… |
CVE-2017-18848 | High | 8.8 | 2020-04-20 | Certain NETGEAR devices are affected by CSRF. This affects R6300v2 before 1.0.0.36, AC1450 before 1.0.0.36, R7300 before 1.0.0.54, and R8500 before 1.0.2.94. |
CVE-2017-18842 | High | 8.8 | 2020-04-20 | Certain NETGEAR devices are affected by CSRF. This affects R7300 before 1.0.0.54, R8500 before 1.0.2.94, DGN2200v1 before 1.0.0.55, and D2200D/D2200DW-1FRNAS b… |
CVE-2017-18852 | High | 8.8 | 2020-04-20 | Certain NETGEAR devices are affected by CSRF and authentication bypass. This affects R7300DST before 1.0.0.54, R8300 before 1.0.2.100_1.0.82, R8500 before 1.0… |
CVE-2020-11825 | High | 8.8 | 2020-04-16 | In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user… |
CVE-2020-11818 | High | 8.8 | 2020-04-16 | In Rukovoditel 2.5.2 has a form_session_token value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, a… |
CVE-2019-20691 | High | 8.8 | 2020-04-16 | Certain NETGEAR devices are affected by CSRF. This affects D3600 before 1.0.0.72, D6000 before 1.0.0.72, EX3700 before 1.0.0.70, EX3800 before 1.0.0.70, EX6000… |
CVE-2020-3261 | Medium | 6.5 | 2020-04-15 | A vulnerability in the web-based management interface of Cisco Mobility Express Software could allow an unauthenticated, remote attacker to conduct a cross-sit… |
CVE-2020-11003 | Medium | 4.8 | 2020-04-14 | Oasis before version 2.15.0 has a potential DNS rebinding or CSRF vulnerability. If you're running a vulnerable application on your computer and an attacker ca… |
CVE-2020-11706 | High | 8.8 | 2020-04-12 | An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The Admin Interface allows CSRF for actions such as: Change any username and password, a… |