CWE-352 · Cross-Site Request Forgery (CSRF) (page 71)
Page 71 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2013-2108 | Medium | 5.4 | 2020-02-10 | WordPress WP Cleanfix Plugin 2.4.4 has CSRF |
CVE-2019-19665 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the FTP Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Ser… |
CVE-2019-19663 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the Folder Sets Settings of Web File Manager in Rumpus FTP 8.2.9.1. This allows an attacker to Create/Delete Folders after explo… |
CVE-2019-19660 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate… |
CVE-2019-19659 | High | 8.8 | 2020-02-10 | A CSRF vulnerability exists in the Web File Manager's Edit Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can take over a u… |
CVE-2019-20059 | High | 8.8 | 2020-02-10 | payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0 parameter into a SQ… |
CVE-2014-2225 | High | 8.8 | 2020-02-08 | Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authenticati… |
CVE-2011-1085 | High | 8.8 | 2020-02-07 | CSRF vulnerability in Smoothwall Express 3. |
CVE-2014-5288 | High | 8.8 | 2020-02-07 | A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages. |
CVE-2013-3568 | High | 8.8 | 2020-02-06 | Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have un… |
CVE-2012-6297 | High | 8.8 | 2020-02-06 | Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could le… |
CVE-2020-8658 | High | 8.8 | 2020-02-06 | The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name… |
CVE-2019-20405 | Medium | 4.3 | 2020-02-06 | The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a C… |
CVE-2019-20401 | Medium | 6.5 | 2020-02-06 | Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being install… |
CVE-2011-0525 | High | 8.8 | 2020-02-05 | Batavi before 1.0 has CSRF. |
CVE-2019-4613 | High | 8.8 | 2020-02-05 | IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2020-8615 | Medium | 6.5 | 2020-02-04 | A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other ma… |
CVE-2019-10784 | Critical | 9.6 | 2020-02-04 | phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "databas… |
CVE-2013-7053 | High | 8.8 | 2020-02-04 | D-Link DIR-100 4.03B07: cli.cgi CSRF |
CVE-2020-8505 | Medium | 6.5 | 2020-01-31 | School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user. |
CVE-2020-8504 | Medium | 6.5 | 2020-01-31 | School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user. |
CVE-2019-7654 | Medium | 6.5 | 2020-01-29 | Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into ma… |
CVE-2020-7965 | High | 8.8 | 2020-01-29 | flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is va… |
CVE-2020-8425 | Medium | 6.5 | 2020-01-28 | Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php. |
CVE-2020-8424 | High | 8.8 | 2020-01-28 | Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php. |
CVE-2020-8420 | High | 8.8 | 2020-01-28 | An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability. |
CVE-2020-8419 | High | 8.8 | 2020-01-28 | An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities. |
CVE-2020-8417 | High | 8.8 | 2020-01-28 | The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu. |
CVE-2013-3093 | High | 8.8 | 2020-01-28 | ASUS RT-N56U devices allow CSRF. |
CVE-2015-5483 | High | 8.8 | 2020-01-28 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication o… |
CVE-2013-4865 | Medium | 6.5 | 2020-01-28 | Cross-site request forgery (CSRF) vulnerability in upgrade_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to hijack the authent… |
CVE-2020-7991 | High | 8.8 | 2020-01-26 | Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password. |
CVE-2014-2050 | Medium | 6.5 | 2020-01-23 | Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of… |
CVE-2019-16513 | High | 8.8 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to send API requests. |
CVE-2020-7210 | Medium | 4.3 | 2020-01-23 | Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts. |
CVE-2011-3612 | High | 8.8 | 2020-01-22 | Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12. |
CVE-2011-3582 | High | 8.8 | 2020-01-22 | A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for sensitive transacti… |
CVE-2020-6849 | High | 8.8 | 2020-01-21 | The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS. |
CVE-2019-3864 | High | 8.8 | 2020-01-21 | A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as… |
CVE-2020-5397 | Medium | 5.3 | 2020-01-17 | Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or… |
CVE-2019-19854 | High | 8.8 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. It does not use CSRF Tokens to mitigate against CSRF; it uses the… |
CVE-2019-18271 | High | 8.8 | 2020-01-15 | OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to a cross-site request forgery that may be introduced on the PI… |
CVE-2020-2098 | High | 8.8 | 2020-01-15 | A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account run… |
CVE-2020-2093 | High | 8.8 | 2020-01-15 | A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers to send an email with fixed content t… |
CVE-2020-2090 | High | 8.8 | 2020-01-15 | A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AW… |
CVE-2020-5502 | Medium | 6.5 | 2020-01-15 | phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. |
CVE-2020-5501 | Medium | 4.3 | 2020-01-15 | phpBB 3.2.8 allows a CSRF attack that can modify a group avatar. |
CVE-2011-2934 | High | 8.8 | 2020-01-14 | A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate confirmation for se… |
CVE-2014-9382 | Medium | 6.5 | 2020-01-13 | Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation |
CVE-2019-14304 | High | 8.8 | 2020-01-10 | Ricoh SP C250DN 1.06 devices allow CSRF. |
CVE-2019-20178 | Medium | 6.5 | 2020-01-09 | Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user. |
CVE-2019-6319 | High | 8.1 | 2020-01-09 | HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or higher) hav… |
CVE-2020-6167 | High | 8.8 | 2020-01-09 | A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify severa… |
CVE-2019-6320 | High | 8.1 | 2020-01-09 | Certain HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or hig… |
CVE-2011-5250 | Medium | 6.5 | 2020-01-08 | Snare for Linux before 1.7.0 has CSRF in the web interface. |
CVE-2019-20077 | Medium | 4.3 | 2020-01-05 | The Typesetter CMS 5.1 logout functionality is affected by a CSRF vulnerability. The logout function of the admin panel is not protected by any CSRF tokens. An… |
CVE-2014-5516 | Medium | 6.5 | 2020-01-03 | Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the… |
CVE-2014-3590 | Medium | 6.5 | 2020-01-02 | Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user… |
CVE-2013-3935 | High | 8.8 | 2020-01-02 | Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack the authentication o… |
CVE-2015-5595 | Medium | 6.5 | 2019-12-31 | Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for r… |
CVE-2019-12273 | Medium | 6.5 | 2019-12-31 | OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE: The product is self-hosted by the cust… |
CVE-2013-0196 | Medium | 6.5 | 2019-12-30 | A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. T… |
CVE-2019-19737 | High | 8.8 | 2019-12-30 | MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requests and potentiall… |
CVE-2019-20071 | Medium | 6.5 | 2019-12-30 | On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs. |
CVE-2014-3136 | High | 8.8 | 2019-12-27 | Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote attackers to hijack the authentication o… |
CVE-2013-4665 | Medium | 6.5 | 2019-12-27 | SPBAS Business Automation Software 2012 has CSRF. |
CVE-2019-19995 | High | 8.8 | 2019-12-26 | A CSRF issue was discovered on Intelbras IWR 3000N 1.8.7 devices, leading to complete control of the router, as demonstrated by v1/system/user. |
CVE-2019-16326 | High | 8.8 | 2019-12-26 | D-Link DIR-601 B1 2.00NA devices have CSRF because no anti-CSRF token is implemented. A remote attacker could exploit this in conjunction with CVE-2019-16327 t… |
CVE-2019-6030 | High | 8.8 | 2019-12-26 | Cross-site request forgery (CSRF) vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to hijack the authentication of administrators v… |
CVE-2019-6027 | High | 8.8 | 2019-12-26 | Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of administrators via… |
CVE-2019-19981 | Medium | 5.4 | 2019-12-26 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings. |
CVE-2019-19979 | High | 8.8 | 2019-12-26 | A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affecti… |
CVE-2019-4736 | Medium | 4.3 | 2019-12-20 | IBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions t… |
CVE-2019-4231 | Medium | 4.3 | 2019-12-20 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tran… |
CVE-2018-1934 | High | 8.8 | 2019-12-20 | IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2019-19915 | Critical | 9.0 | 2019-12-19 | The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redi… |
CVE-2019-17633 | High | 8.8 | 2019-12-19 | For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che wo… |
CVE-2019-19833 | Medium | 6.5 | 2019-12-18 | In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications t… |
CVE-2019-19832 | High | 8.8 | 2019-12-18 | Xerox AltaLink C8035 printers allow CSRF. A request to add users is made in the Device User Database form field to the xerox.set URI. (The frmUserName value mu… |
CVE-2019-11657 | High | 8.8 | 2019-12-17 | Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0. The vulnerability could be exploi… |
CVE-2019-16575 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2019-16573 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL… |
CVE-2019-16570 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specified web server. |
CVE-2019-16569 | Medium | 4.3 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified web server using atta… |
CVE-2019-16565 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using atta… |
CVE-2019-16560 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine wh… |
CVE-2019-16553 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationa… |
CVE-2019-16551 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or… |
CVE-2019-16550 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins… |
CVE-2017-18107 | Medium | 6.5 | 2019-12-17 | Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups… |
CVE-2014-0197 | High | 8.8 | 2019-12-13 | CFME: CSRF protection vulnerability via permissive check of the referrer header |
CVE-2019-13930 | High | 8.1 | 2019-12-12 | A vulnerability has been identified in XHQ (All versions < V6.0.0.2). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecti… |
CVE-2019-15934 | High | 8.8 | 2019-12-12 | Intesync Solismed 3.3sp has CSRF. |
CVE-2019-0398 | High | 8.8 | 2019-12-11 | Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to… |
CVE-2014-0026 | Medium | 6.5 | 2019-12-11 | katello-headpin is vulnerable to CSRF in REST API |
CVE-2019-4095 | Medium | 4.3 | 2019-12-10 | IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted fr… |
CVE-2019-19685 | High | 8.8 | 2019-12-09 | RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions. |
CVE-2019-16752 | Medium | 4.3 | 2019-12-04 | An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It is possible to force wallets to send HTTP requests to arbitrary… |
CVE-2019-18346 | High | 8.8 | 2019-12-04 | A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests… |
CVE-2019-19516 | Medium | 6.5 | 2019-12-02 | Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp to the goform/SysToolChangePwd URI to change a password. |