CWE-352 · Cross-Site Request Forgery (CSRF) (page 74)
Page 74 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-14668 | High | 8.8 | 2019-08-15 | In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protoc… |
CVE-2019-15062 | High | 8.0 | 2019-08-14 | An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings pag… |
CVE-2019-14526 | High | 8.1 | 2019-08-14 | An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically… |
CVE-2019-14216 | High | 8.8 | 2019-08-14 | An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mi… |
CVE-2019-10199 | High | 8.8 | 2019-08-14 | It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an… |
CVE-2018-20968 | High | 8.8 | 2019-08-14 | The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF. |
CVE-2018-20967 | High | 8.8 | 2019-08-14 | The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF. |
CVE-2017-18513 | High | 8.8 | 2019-08-14 | The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface. |
CVE-2017-18512 | High | 8.8 | 2019-08-14 | The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF. |
CVE-2017-18511 | High | 8.8 | 2019-08-14 | The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF. |
CVE-2017-18510 | High | 8.8 | 2019-08-14 | The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions. |
CVE-2016-10885 | High | 8.8 | 2019-08-14 | The wp-editor plugin before 1.2.6 for WordPress has CSRF. |
CVE-2016-10884 | High | 8.8 | 2019-08-14 | The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues. |
CVE-2016-10883 | Medium | 6.5 | 2019-08-14 | The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users. |
CVE-2016-10882 | High | 8.8 | 2019-08-14 | The google-document-embedder plugin before 2.6.2 for WordPress has CSRF. |
CVE-2015-9309 | High | 8.8 | 2019-08-14 | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature. |
CVE-2015-9308 | High | 8.8 | 2019-08-14 | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature. |
CVE-2015-9307 | High | 8.8 | 2019-08-14 | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature. |
CVE-2013-7476 | High | 8.8 | 2019-08-14 | The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface. |
CVE-2019-11207 | High | 8.8 | 2019-08-13 | The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple… |
CVE-2018-20964 | High | 8.8 | 2019-08-13 | The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF. |
CVE-2017-18504 | High | 8.8 | 2019-08-12 | The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF. |
CVE-2016-10876 | High | 8.8 | 2019-08-12 | The wp-database-backup plugin before 4.3.1 for WordPress has CSRF. |
CVE-2016-10874 | High | 8.8 | 2019-08-12 | The wp-database-backup plugin before 4.3.3 for WordPress has CSRF. |
CVE-2019-14933 | High | 8.8 | 2019-08-11 | Bagisto 0.1.5 allows CSRF under /admin URIs. |
CVE-2016-10865 | Medium | 6.1 | 2019-08-09 | The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated b… |
CVE-2017-18485 | Medium | 5.4 | 2019-08-08 | Cognitoys Dino devices allow profiles_add.html CSRF. |
CVE-2016-10863 | High | 8.8 | 2019-08-08 | Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure. |
CVE-2016-10862 | High | 8.8 | 2019-08-08 | Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page. |
CVE-2015-9292 | High | 8.8 | 2019-08-08 | 6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter). |
CVE-2019-14683 | Medium | 5.7 | 2019-08-08 | The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF. |
CVE-2019-14682 | Medium | 4.3 | 2019-08-08 | The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF. |
CVE-2019-14681 | High | 8.8 | 2019-08-08 | The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF. |
CVE-2019-14680 | Medium | 5.7 | 2019-08-08 | The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF. |
CVE-2019-14679 | Medium | 6.5 | 2019-08-08 | core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF. |
CVE-2019-1958 | High | 8.8 | 2019-08-08 | A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to conduct a cross-site reque… |
CVE-2019-10388 | Medium | 4.3 | 2019-08-07 | A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate… |
CVE-2019-10386 | High | 8.8 | 2019-08-07 | A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Ov… |
CVE-2019-10368 | High | 8.8 | 2019-08-07 | A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.Desc… |
CVE-2016-10861 | Medium | 6.5 | 2019-08-07 | Neet AirStream NAS1.1 devices allow CSRF attacks that cause the settings binary to change the AP name and password. |
CVE-2019-14703 | High | 8.8 | 2019-08-06 | A CSRF issue was discovered in webparam?user&action=set¶m=add in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 to create an admin… |
CVE-2019-14346 | High | 8.8 | 2019-08-06 | Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password. |
CVE-2019-14551 | Critical | 9.8 | 2019-08-03 | Das Q before 2019-08-02 allows web sites to execute arbitrary code on client machines, as demonstrated by a cross-origin /install request with an attacker-cont… |
CVE-2019-7947 | Medium | 6.5 | 2019-08-02 | A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior t… |
CVE-2019-7874 | Medium | 6.5 | 2019-08-02 | A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in un… |
CVE-2019-7873 | Medium | 4.3 | 2019-08-02 | A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in un… |
CVE-2019-7865 | High | 8.8 | 2019-08-02 | A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prio… |
CVE-2019-7857 | Medium | 4.3 | 2019-08-02 | A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause unwanted items to b… |
CVE-2019-7851 | Medium | 6.5 | 2019-08-02 | A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unintended data d… |
CVE-2019-10176 | Medium | 4.2 | 2019-08-02 | A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain… |
CVE-2013-7473 | High | 8.8 | 2019-08-01 | Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account. |
CVE-2018-10899 | High | 8.1 | 2019-08-01 | A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured… |
CVE-2019-10186 | High | 8.8 | 2019-07-31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool. |
CVE-2019-3959 | High | 8.8 | 2019-07-31 | Cross-site request forgery in WallacePOS 1.4.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a c… |
CVE-2018-20872 | Medium | 6.5 | 2019-07-31 | DrayTek routers before 2018-05-23 allow CSRF attacks to change DNS or DHCP settings, a related issue to CVE-2017-11649. |
CVE-2019-10359 | Medium | 6.3 | 2019-07-31 | A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowed attackers to perfo… |
CVE-2019-14327 | Medium | 6.5 | 2019-07-30 | A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings. |
CVE-2016-10766 | High | 8.8 | 2019-07-29 | edx-platform before 2016-06-06 allows CSRF. |
CVE-2019-14328 | High | 8.8 | 2019-07-28 | The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. |
CVE-2019-14228 | Medium | 6.1 | 2019-07-26 | Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/includes/adminprocess… |
CVE-2019-4212 | High | 8.8 | 2019-07-25 | IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2019-11712 | High | 8.8 | 2019-07-23 | POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to per… |
CVE-2019-14240 | High | 8.1 | 2019-07-23 | WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI. |
CVE-2019-12934 | High | 8.8 | 2019-07-20 | An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as d… |
CVE-2018-17792 | High | 8.8 | 2019-07-19 | MDaemon Webmail (formerly WorldClient) has CSRF. |
CVE-2019-13974 | High | 8.8 | 2019-07-19 | LayerBB 1.1.3 allows conversations.php/cmd/new CSRF. |
CVE-2019-7953 | Medium | 6.5 | 2019-07-18 | Adobe Experience Manager version 6.4 and ealier have a Cross-Site Request Forgery vulnerability. Successful exploitation could lead to Sensitive Information di… |
CVE-2019-13961 | High | 8.8 | 2019-07-18 | A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php. |
CVE-2019-1010112 | High | 8.8 | 2019-07-18 | OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery (CSRF). The impact is: The victim clicks on adding an administrator account. The co… |
CVE-2019-9231 | High | 8.8 | 2019-07-18 | An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202.307. A Cross-Site R… |
CVE-2019-13949 | High | 8.8 | 2019-07-18 | SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change. |
CVE-2019-1010096 | High | 8.8 | 2019-07-18 | DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin… |
CVE-2019-1010095 | High | 8.8 | 2019-07-18 | DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can add the administrator account. The c… |
CVE-2019-1010094 | High | 8.8 | 2019-07-18 | domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component… |
CVE-2019-1010054 | High | 8.8 | 2019-07-18 | Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable passwo… |
CVE-2019-10353 | High | 7.5 | 2019-07-17 | CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection. |
CVE-2019-13611 | High | 8.8 | 2019-07-16 | An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSock… |
CVE-2019-13594 | High | 8.8 | 2019-07-14 | In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid… |
CVE-2019-13563 | High | 8.8 | 2019-07-11 | D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console. |
CVE-2019-12363 | High | 8.8 | 2019-07-11 | An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to con… |
CVE-2019-10340 | High | 8.8 | 2019-07-11 | A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/R… |
CVE-2019-12466 | High | 8.8 | 2019-07-10 | Wikimedia MediaWiki through 1.32.1 allows CSRF. |
CVE-2019-13071 | High | 8.8 | 2019-07-10 | CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST requests to any forms in the web applicati… |
CVE-2018-12628 | High | 8.8 | 2019-07-10 | An issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another user with admin privileges. |
CVE-2019-12923 | Medium | 6.5 | 2019-07-08 | In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible… |
CVE-2019-13401 | High | 8.8 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/. |
CVE-2019-13183 | High | 8.8 | 2019-07-07 | Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings. |
CVE-2019-13370 | High | 8.8 | 2019-07-06 | index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator. |
CVE-2019-5984 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of administrators via… |
CVE-2019-5983 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in HTML5 Maps 1.6.5.6 and earlier allows remote attackers to hijack the authentication of administrators via un… |
CVE-2019-5980 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Related YouTube Videos versions prior to 1.9.9 allows remote attackers to hijack the authentication of admin… |
CVE-2019-5979 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Personalized WooCommerce Cart Page 2.4 and earlier allows remote attackers to hijack the authentication of a… |
CVE-2019-5974 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrat… |
CVE-2019-5973 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrato… |
CVE-2019-5971 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to hijack the authentication of administrators… |
CVE-2019-5968 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in GROWI v3.4.6 and earlier allows remote attackers to hijack the authentication of administrators via updating… |
CVE-2019-5963 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to hijack the authentication of administrators via un… |
CVE-2019-5960 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in WP Open Graph 1.6.1 and earlier allows remote attackers to hijack the authentication of administrators via u… |
CVE-2019-6636 | High | 8.4 | 2019-07-03 | On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM fe… |
CVE-2019-12851 | High | 8.8 | 2019-07-03 | A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852. |