CWE-352 · Cross-Site Request Forgery (CSRF) (page 74)
Page 74 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-18884 | High | 8.8 | 2019-11-13 | index.php/team_members/add_team_member in RISE Ultimate Project Manager 2.3 has CSRF for adding authorized users. |
CVE-2013-3516 | Medium | 6.5 | 2019-11-13 | NETGEAR WNR3500U and WNR3500L routers uses form tokens abased solely on router's current date and time, which allows attackers to guess the CSRF tokens. |
CVE-2012-4385 | Medium | 6.5 | 2019-11-13 | letodms 3.3.6 has CSRF via change password |
CVE-2014-3655 | Medium | 4.3 | 2019-11-13 | JBoss KeyCloak is vulnerable to soft token deletion via CSRF |
CVE-2010-3305 | High | 8.8 | 2019-11-12 | Cross-site request forgery (CSRF) vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password. |
CVE-2019-17237 | High | 8.8 | 2019-11-12 | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF. |
CVE-2019-18411 | High | 8.8 | 2019-11-06 | Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be f… |
CVE-2019-18650 | High | 8.8 | 2019-11-06 | An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability. |
CVE-2019-8155 | High | 7.5 | 2019-11-06 | Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request. This could be exploited by an attacker with access to… |
CVE-2019-8109 | High | 8.0 | 2019-11-05 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft a maliciou… |
CVE-2013-6275 | Medium | 6.5 | 2019-11-05 | Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php. |
CVE-2013-6365 | Medium | 5.3 | 2019-11-05 | Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions |
CVE-2013-6364 | High | 8.8 | 2019-11-05 | Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book |
CVE-2019-13497 | Medium | 6.5 | 2019-11-04 | One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows CSRF for logout requests. |
CVE-2019-18206 | High | 8.8 | 2019-10-30 | A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload. |
CVE-2019-9926 | High | 8.8 | 2019-10-29 | An issue was discovered in LabKey Server 19.1.0. It is possible to force a logged-in administrator to execute code through a /reports-viewScriptReport.view CSR… |
CVE-2010-4241 | High | 8.8 | 2019-10-28 | Tiki Wiki CMS Groupware 5.2 has CSRF |
CVE-2013-4848 | High | 8.8 | 2019-10-25 | TP-Link TL-WDR4300 version 3.13.31 has multiple CSRF vulnerabilities. |
CVE-2019-8234 | Medium | 6.5 | 2019-10-25 | Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a cross-site request forgery vulnerability. Successful exploitation could lead to sensitive information… |
CVE-2019-18414 | High | 8.8 | 2019-10-24 | Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protectio… |
CVE-2019-12095 | High | 8.8 | 2019-10-24 | Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to t… |
CVE-2019-9597 | Medium | 6.5 | 2019-10-23 | Darktrace Enterprise Immune System before 3.1 allows CSRF via the /config endpoint. |
CVE-2019-9596 | Medium | 6.5 | 2019-10-23 | Darktrace Enterprise Immune System before 3.1 allows CSRF via the /whitelisteddomains endpoint. |
CVE-2019-18280 | High | 8.8 | 2019-10-23 | Sourcecodester Online Grading System 1.0 is affected by a Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an atta… |
CVE-2019-18220 | High | 8.8 | 2019-10-23 | Sitemagic CMS 4.4.1 is affected by a Cross-Site-Request-Forgery (CSRF) issue as it doesn't implement any method to validate incoming requests, allowing the exe… |
CVE-2019-10471 | High | 8.8 | 2019-10-23 | A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server using attacker-spec… |
CVE-2019-10468 | High | 8.8 | 2019-10-23 | A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-specified URL using… |
CVE-2019-10464 | High | 8.8 | 2019-10-23 | A cross-site request forgery vulnerability in Jenkins Deploy WebLogic Plugin allows attackers to connect to an attacker-specified URL using attacker-specified… |
CVE-2019-10462 | High | 8.1 | 2019-10-23 | A cross-site request forgery vulnerability in Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier allowed attackers to connect to an attacker-spe… |
CVE-2015-9498 | High | 8.8 | 2019-10-22 | The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value. |
CVE-2015-9497 | High | 8.8 | 2019-10-22 | The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php. |
CVE-2019-17367 | High | 8.8 | 2019-10-18 | OpenWRT firmware version 18.06.4 is vulnerable to CSRF via wireless/radio0.network1, wireless/radio1.network1, firewall, firewall/zones, firewall/forwards, fir… |
CVE-2019-17118 | High | 8.8 | 2019-10-17 | A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such… |
CVE-2019-17676 | High | 8.8 | 2019-10-17 | app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstr… |
CVE-2019-17675 | High | 8.8 | 2019-10-17 | WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF. |
CVE-2019-12636 | High | 8.8 | 2019-10-16 | A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to con… |
CVE-2019-10456 | Medium | 4.3 | 2019-10-16 | A cross-site request forgery vulnerability in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers to connect to an attacker-specified U… |
CVE-2019-10454 | Medium | 4.3 | 2019-10-16 | A cross-site request forgery vulnerability in Jenkins Rundeck Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credenti… |
CVE-2019-10441 | Medium | 4.3 | 2019-10-16 | A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specified URL using attacke… |
CVE-2019-10437 | High | 8.8 | 2019-10-16 | A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers to connect to an attacker-specifi… |
CVE-2016-11015 | Medium | 6.5 | 2019-10-16 | NETGEAR JNR1010 devices before 1.0.0.32 allow cgi-bin/webproc CSRF via the :InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL parameter. |
CVE-2019-17600 | Critical | 9.8 | 2019-10-15 | Intelbras IWR 1000N 1.6.4 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled. |
CVE-2019-17593 | High | 8.8 | 2019-10-14 | JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator. |
CVE-2019-17521 | Medium | 6.5 | 2019-10-12 | An issue was discovered in Landing-CMS 0.0.6. There is a CSRF vulnerability that can change the admin's password via the password/ URI, |
CVE-2018-20582 | High | 8.8 | 2019-10-11 | The GREE+ (aka com.gree.greeplus) application 1.4.0.8 for Android suffers from Cross Site Request Forgery. |
CVE-2019-17495 | Critical | 9.8 | 2019-10-10 | A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perf… |
CVE-2019-17386 | High | 8.8 | 2019-10-10 | The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php. |
CVE-2019-17432 | Medium | 6.5 | 2019-10-10 | An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/admin/general.config/edit CSRF vulnerability, as demonstrated by resultant XSS via… |
CVE-2019-17431 | High | 8.8 | 2019-10-10 | An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability. |
CVE-2019-13529 | High | 8.8 | 2019-10-09 | An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on t… |
CVE-2019-17369 | Medium | 6.5 | 2019-10-09 | OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin. |
CVE-2015-9455 | High | 8.1 | 2019-10-07 | The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parame… |
CVE-2019-17217 | High | 8.8 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no CSRF protection established on the web service. |
CVE-2019-1915 | Medium | 6.5 | 2019-10-02 | A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisc… |
CVE-2019-15040 | High | 8.8 | 2019-10-02 | JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page. |
CVE-2019-16993 | High | 8.8 | 2019-09-30 | In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An ac… |
CVE-2019-13376 | Medium | 6.5 | 2019-09-27 | phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking… |
CVE-2019-16667 | High | 8.8 | 2019-09-26 | diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csr… |
CVE-2015-9447 | Medium | 6.5 | 2019-09-26 | The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters. |
CVE-2015-9445 | High | 8.8 | 2019-09-26 | The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation. |
CVE-2015-9443 | Medium | 6.5 | 2019-09-26 | The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP. |
CVE-2015-9442 | Medium | 6.5 | 2019-09-26 | The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin. |
CVE-2015-9441 | Medium | 6.5 | 2019-09-26 | The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php. |
CVE-2015-9440 | Medium | 6.5 | 2019-09-26 | The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new. |
CVE-2015-9437 | Medium | 6.5 | 2019-09-26 | The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter. |
CVE-2015-9434 | Medium | 6.5 | 2019-09-26 | The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or t… |
CVE-2015-9433 | Medium | 6.5 | 2019-09-26 | The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc… |
CVE-2015-9432 | Medium | 6.5 | 2019-09-26 | The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile… |
CVE-2015-9431 | Medium | 6.5 | 2019-09-26 | The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json… |
CVE-2015-9429 | Medium | 6.5 | 2019-09-26 | The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page param… |
CVE-2015-9428 | Medium | 6.5 | 2019-09-26 | The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone… |
CVE-2015-9427 | Medium | 6.5 | 2019-09-26 | The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter. |
CVE-2015-9425 | Medium | 5.4 | 2019-09-26 | The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallock… |
CVE-2015-9424 | Medium | 6.5 | 2019-09-26 | The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or adm… |
CVE-2015-9422 | Medium | 6.5 | 2019-09-26 | The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_di… |
CVE-2015-9421 | Medium | 6.5 | 2019-09-26 | The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter. |
CVE-2015-9418 | Medium | 4.3 | 2019-09-26 | The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes. |
CVE-2015-9417 | Medium | 6.5 | 2019-09-26 | The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS. |
CVE-2015-9413 | Medium | 6.5 | 2019-09-26 | The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter. |
CVE-2015-9409 | Medium | 6.5 | 2019-09-25 | The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php. |
CVE-2019-10408 | Medium | 4.3 | 2019-09-25 | A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project generation from templat… |
CVE-2019-4515 | Medium | 6.5 | 2019-09-24 | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorize… |
CVE-2019-16721 | Medium | 6.5 | 2019-09-23 | NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user. |
CVE-2019-16719 | Medium | 6.5 | 2019-09-23 | WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS. |
CVE-2019-16706 | High | 8.8 | 2019-09-23 | kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php. |
CVE-2019-16678 | Medium | 6.5 | 2019-09-21 | admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. |
CVE-2019-16677 | Medium | 6.5 | 2019-09-21 | An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF. |
CVE-2019-16660 | High | 8.8 | 2019-09-21 | joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF. |
CVE-2019-16659 | High | 8.8 | 2019-09-21 | TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF. |
CVE-2019-16658 | High | 8.8 | 2019-09-21 | TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF. |
CVE-2018-17789 | Medium | 6.5 | 2019-09-20 | Prospecta Master Data Online (MDO) allows CSRF. |
CVE-2015-9408 | Medium | 6.5 | 2019-09-20 | The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS. |
CVE-2015-9394 | High | 8.8 | 2019-09-20 | The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php. |
CVE-2016-10997 | Medium | 6.5 | 2019-09-20 | The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php. |
CVE-2015-9388 | Medium | 6.5 | 2019-09-20 | The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS. |
CVE-2015-9387 | Medium | 6.5 | 2019-09-20 | The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF. |
CVE-2019-15089 | High | 8.8 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator. |
CVE-2019-16531 | High | 8.8 | 2019-09-20 | LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php. |
CVE-2016-10989 | High | 8.8 | 2019-09-17 | The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF. |
CVE-2016-10982 | High | 8.8 | 2019-09-17 | The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF. |