CWE-352 · Cross-Site Request Forgery (CSRF) (page 72)
Page 72 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12769 | High | 8.8 | 2020-03-18 | SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request Forgery in the file upload functionality vi… |
CVE-2020-4199 | Medium | 4.3 | 2020-03-18 | IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transm… |
CVE-2018-21037 | High | 8.8 | 2020-03-17 | Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI. |
CVE-2020-9346 | High | 8.8 | 2020-03-16 | Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's… |
CVE-2020-6585 | High | 8.8 | 2020-03-16 | Nagios Log Server 2.1.3 has CSRF. |
CVE-2020-10241 | High | 8.8 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF. |
CVE-2020-10568 | High | 8.8 | 2020-03-14 | The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes… |
CVE-2019-13199 | Medium | 6.5 | 2020-03-13 | Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) did not implement any mechanism to avoid CSRF. Successful exploitation of this vulnerabili… |
CVE-2019-13170 | Medium | 6.5 | 2020-03-13 | Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement any mechanism to avoid CSRF attacks. Successful exploitation of this vulnerabili… |
CVE-2019-13395 | High | 8.8 | 2020-03-13 | The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs. An attacker can modify all settings including WEP/WPA/WPA2 keys… |
CVE-2020-10540 | High | 8.8 | 2020-03-13 | Untis WebUntis before 2020.9.6 allows CSRF for certain combinations of rights and modules. |
CVE-2019-17653 | High | 8.8 | 2020-03-12 | A Cross-Site Request Forgery (CSRF) vulnerability in the user interface of Fortinet FortiSIEM 5.2.5 could allow a remote, unauthenticated attacker to perform a… |
CVE-2020-10504 | Medium | 4.3 | 2020-03-12 | CSRF in admin/edit-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a comment, given the id, via a crafted request. |
CVE-2020-10503 | Medium | 4.3 | 2020-03-12 | CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to disapprove any comment, given the id, via a crafted request. |
CVE-2020-10502 | Medium | 4.3 | 2020-03-12 | CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to approve any comment, given the id, via a crafted request. |
CVE-2020-10501 | Medium | 6.5 | 2020-03-12 | CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a department, given the id, via a crafted request. |
CVE-2020-10500 | Medium | 4.3 | 2020-03-12 | CSRF in admin/reply-ticket.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to reply to any ticket, given the id, via a crafted request. |
CVE-2020-10499 | Medium | 4.3 | 2020-03-12 | CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to close any ticket, given the id, via a crafted request. |
CVE-2020-10498 | Medium | 6.5 | 2020-03-12 | CSRF in admin/edit-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a category, given the id, via a crafted request. |
CVE-2020-10497 | Medium | 6.5 | 2020-03-12 | CSRF in admin/manage-categories.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a category via a crafted request. |
CVE-2020-10496 | Medium | 4.3 | 2020-03-12 | CSRF in admin/edit-article.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article, given the id, via a crafted request. |
CVE-2020-10495 | Medium | 4.3 | 2020-03-12 | CSRF in admin/edit-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article template, given the id, via a crafted request. |
CVE-2020-10494 | Medium | 4.3 | 2020-03-12 | CSRF in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a news article, given the id, via a crafted request. |
CVE-2020-10493 | Medium | 4.3 | 2020-03-12 | CSRF in admin/edit-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a glossary term, given the id, via a crafted request. |
CVE-2020-10492 | Medium | 4.3 | 2020-03-12 | CSRF in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article template via a crafted request. |
CVE-2020-10491 | Medium | 4.3 | 2020-03-12 | CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a department via a crafted request. |
CVE-2020-10490 | Medium | 4.3 | 2020-03-12 | CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a department via a crafted request. |
CVE-2020-10489 | Medium | 4.3 | 2020-03-12 | CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a ticket via a crafted request. |
CVE-2020-10488 | Medium | 4.3 | 2020-03-12 | CSRF in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a news article via a crafted request. |
CVE-2020-10487 | Medium | 4.3 | 2020-03-12 | CSRF in admin/manage-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a glossary term via a crafted request. |
CVE-2020-10486 | Medium | 4.3 | 2020-03-12 | CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a comment via a crafted request. |
CVE-2020-10485 | Medium | 4.3 | 2020-03-12 | CSRF in admin/manage-articles.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article via a crafted request. |
CVE-2020-10484 | Medium | 4.3 | 2020-03-12 | CSRF in admin/add-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to create a custom field via a crafted request. |
CVE-2020-10483 | Medium | 4.3 | 2020-03-12 | CSRF in admin/ajax-hub.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to post a comment on any article via a crafted request. |
CVE-2020-10482 | Medium | 4.3 | 2020-03-12 | CSRF in admin/add-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new article template via a crafted request. |
CVE-2020-10481 | Medium | 4.3 | 2020-03-12 | CSRF in admin/add-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new glossary term via a crafted request. |
CVE-2020-10480 | Medium | 4.3 | 2020-03-12 | CSRF in admin/add-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new category via a crafted request. |
CVE-2020-10479 | Medium | 4.3 | 2020-03-12 | CSRF in admin/add-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new news article via a crafted request. |
CVE-2020-10478 | High | 8.8 | 2020-03-12 | CSRF in admin/manage-settings.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to change the global settings, potentially gaining code execution… |
CVE-2020-10181 | Critical | 9.8 | 2020-03-11 | goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a devic… |
CVE-2019-16107 | Medium | 4.3 | 2020-03-11 | Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments. |
CVE-2020-6206 | Medium | 4.3 | 2020-03-10 | SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim t… |
CVE-2020-2147 | Medium | 4.3 | 2020-03-09 | A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attack… |
CVE-2020-2141 | Medium | 4.3 | 2020-03-09 | A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce. |
CVE-2020-9454 | High | 8.8 | 2020-03-06 | A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator… |
CVE-2019-17642 | High | 8.8 | 2020-03-05 | An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell metacharacters in a… |
CVE-2020-3148 | High | 7.1 | 2020-03-04 | A vulnerability in the web-based interface of Cisco Prime Network Registrar (CPNR) could allow an unauthenticated, remote attacker to conduct a cross-site requ… |
CVE-2020-10057 | High | 8.8 | 2020-03-04 | GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control. This issue exists because of an incomplete fix for CVE-2015-2680, in wh… |
CVE-2020-7988 | High | 8.8 | 2020-03-04 | An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and… |
CVE-2019-20487 | High | 8.8 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticate… |
CVE-2015-1583 | High | 8.8 | 2020-03-02 | Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests tha… |
CVE-2020-5402 | High | 8.8 | 2020-02-27 | In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when… |
CVE-2015-5686 | High | 8.8 | 2020-02-27 | Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an atta… |
CVE-2019-4726 | Medium | 4.3 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malic… |
CVE-2019-19987 | Medium | 6.5 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows Cross-Site Request Forgery (CSRF) on any HTML form. An attacker c… |
CVE-2020-9394 | High | 8.8 | 2020-02-25 | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF. |
CVE-2020-9018 | Medium | 5.3 | 2020-02-25 | LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user. |
CVE-2019-20480 | High | 8.8 | 2020-02-24 | In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a malicious mail is allowed to make arbitrary chan… |
CVE-2020-9341 | High | 8.8 | 2020-02-22 | CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI. |
CVE-2012-2629 | High | 8.8 | 2020-02-20 | Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier allow remote attackers to hijack the authe… |
CVE-2020-3114 | High | 8.8 | 2020-02-19 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a… |
CVE-2019-12437 | High | 8.8 | 2020-02-19 | In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations, |
CVE-2019-12246 | Medium | 4.3 | 2020-02-19 | SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools. |
CVE-2020-9271 | Medium | 6.5 | 2020-02-18 | ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php. |
CVE-2020-9270 | High | 8.8 | 2020-02-18 | ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php. |
CVE-2020-9267 | Medium | 6.5 | 2020-02-18 | SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php. |
CVE-2020-9266 | Medium | 6.5 | 2020-02-18 | SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php. |
CVE-2020-6844 | High | 8.8 | 2020-02-18 | In TopManage OLK 2020, login CSRF can be chained with another vulnerability in order to takeover admin and user accounts. |
CVE-2013-4227 | High | 8.8 | 2020-02-18 | Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for… |
CVE-2020-5530 | High | 8.8 | 2020-02-18 | Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authentication of adminis… |
CVE-2020-1692 | High | 8.1 | 2020-02-17 | Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course. |
CVE-2013-4792 | Medium | 5.5 | 2020-02-14 | PrestaShop before 1.4.11 allows logout CSRF. |
CVE-2020-1977 | High | 7.5 | 2020-02-12 | Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of… |
CVE-2020-2116 | High | 8.8 | 2020-02-12 | A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified… |
CVE-2019-20100 | Medium | 4.7 | 2020-02-12 | The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions prior to 5.4.21, f… |
CVE-2019-20099 | Medium | 4.3 | 2020-02-12 | The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSR… |
CVE-2019-20098 | Medium | 4.3 | 2020-02-12 | The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CS… |
CVE-2012-6721 | Medium | 6.3 | 2020-02-11 | Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) Forum, (2) Event, and (3) Classifieds plugins in SocialEngine before 4.2.4. |
CVE-2019-19668 | Medium | 4.3 | 2020-02-10 | A CSRF vulnerability exists in the File Types component of Web File Manager in Rumpus FTP 8.2.9.1 that allows an attacker to add or delete the file types that… |
CVE-2019-19669 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1. This could allow an attacker to delete, create, and… |
CVE-2019-19667 | Medium | 5.4 | 2020-02-10 | A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an attacker to whitelist or block any IP… |
CVE-2019-19666 | Medium | 4.3 | 2020-02-10 | A CSRF vulnerability exists in the Event Notices Settings of Web File Manager in Rumpus FTP 8.2.9.1. An attacker can create/update event notices via RAPR/Event… |
CVE-2019-19664 | High | 7.1 | 2020-02-10 | A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Ser… |
CVE-2019-19662 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can Crea… |
CVE-2013-2109 | High | 8.8 | 2020-02-10 | WordPress plugin wp-cleanfix has Remote Code Execution |
CVE-2013-2108 | Medium | 5.4 | 2020-02-10 | WordPress WP Cleanfix Plugin 2.4.4 has CSRF |
CVE-2019-19665 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the FTP Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Ser… |
CVE-2019-19663 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the Folder Sets Settings of Web File Manager in Rumpus FTP 8.2.9.1. This allows an attacker to Create/Delete Folders after explo… |
CVE-2019-19660 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate… |
CVE-2019-19659 | High | 8.8 | 2020-02-10 | A CSRF vulnerability exists in the Web File Manager's Edit Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can take over a u… |
CVE-2019-20059 | High | 8.8 | 2020-02-10 | payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0 parameter into a SQ… |
CVE-2014-2225 | High | 8.8 | 2020-02-08 | Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authenticati… |
CVE-2011-1085 | High | 8.8 | 2020-02-07 | CSRF vulnerability in Smoothwall Express 3. |
CVE-2014-5288 | High | 8.8 | 2020-02-07 | A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages. |
CVE-2013-3568 | High | 8.8 | 2020-02-06 | Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have un… |
CVE-2012-6297 | High | 8.8 | 2020-02-06 | Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could le… |
CVE-2020-8658 | High | 8.8 | 2020-02-06 | The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name… |
CVE-2019-20405 | Medium | 4.3 | 2020-02-06 | The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a C… |
CVE-2019-20401 | Medium | 6.5 | 2020-02-06 | Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being install… |
CVE-2011-0525 | High | 8.8 | 2020-02-05 | Batavi before 1.0 has CSRF. |