CWE-352 · Cross-Site Request Forgery (CSRF) (page 75)
Page 75 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10978 | High | 8.8 | 2019-09-17 | The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF. |
CVE-2016-10974 | High | 8.8 | 2019-09-17 | The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS. |
CVE-2016-10962 | Medium | 6.5 | 2019-09-16 | The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter. |
CVE-2019-16311 | High | 8.8 | 2019-09-14 | NIUSHOP V1.11 has CSRF via search_info to index.php. |
CVE-2019-13920 | Medium | 4.3 | 2019-09-13 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some parts of the web application are not protected against Cros… |
CVE-2019-13364 | Critical | 9.6 | 2019-09-13 | admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. This is exploitable… |
CVE-2019-13363 | Critical | 9.6 | 2019-09-13 | admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_… |
CVE-2019-12922 | Medium | 6.5 | 2019-09-13 | A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. |
CVE-2016-10946 | High | 8.8 | 2019-09-13 | The wp-d3 plugin before 2.4.1 for WordPress has CSRF. |
CVE-2016-10945 | High | 8.8 | 2019-09-13 | The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF. |
CVE-2016-10944 | High | 8.8 | 2019-09-13 | The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF. |
CVE-2016-10938 | Medium | 6.5 | 2019-09-13 | The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location. |
CVE-2019-5993 | High | 8.8 | 2019-09-12 | Cross-site request forgery (CSRF) vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers to hijack the authe… |
CVE-2019-5992 | High | 8.8 | 2019-09-12 | Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentic… |
CVE-2019-5986 | High | 8.8 | 2019-09-12 | Cross-site request forgery (CSRF) vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHON… |
CVE-2019-1261 | High | 8.8 | 2019-09-11 | A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery… |
CVE-2019-1259 | High | 8.8 | 2019-09-11 | A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery… |
CVE-2019-14998 | Medium | 6.5 | 2019-09-11 | The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection vi… |
CVE-2017-18607 | High | 8.8 | 2019-09-10 | The avada theme before 5.1.5 for WordPress has CSRF. |
CVE-2019-10253 | Medium | 6.5 | 2019-09-09 | A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upload malicious/forge… |
CVE-2019-16099 | High | 8.8 | 2019-09-08 | Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows CSRF via JSON data to a .swf file. |
CVE-2019-15128 | Medium | 6.5 | 2019-09-06 | iF.SVNAdmin through 1.6.2 allows svnadmin/usercreate.php CSRF to create a user. |
CVE-2019-16059 | High | 8.8 | 2019-09-06 | Sentrifugo 3.2 lacks CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code at index.php/dashboard/viewprofil… |
CVE-2019-15868 | High | 8.8 | 2019-09-03 | The affiliates-manager plugin before 2.6.6 for WordPress has CSRF. |
CVE-2019-15865 | High | 8.8 | 2019-09-03 | The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF. |
CVE-2019-15841 | High | 8.8 | 2019-08-30 | The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_v… |
CVE-2019-15840 | High | 8.8 | 2019-08-30 | The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF. |
CVE-2019-15835 | High | 8.8 | 2019-08-30 | The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF. |
CVE-2019-15834 | High | 8.8 | 2019-08-30 | The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF. |
CVE-2019-15832 | High | 8.8 | 2019-08-30 | The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF. |
CVE-2019-15831 | High | 8.8 | 2019-08-30 | The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page. |
CVE-2019-15828 | High | 8.8 | 2019-08-30 | The one-click-ssl plugin before 1.4.7 for WordPress has CSRF. |
CVE-2015-9380 | High | 8.8 | 2019-08-30 | The photo-gallery plugin before 1.2.42 for WordPress has CSRF. |
CVE-2019-15781 | High | 8.8 | 2019-08-29 | The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF. |
CVE-2019-15779 | High | 8.8 | 2019-08-29 | The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete. |
CVE-2019-15770 | High | 8.8 | 2019-08-29 | The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks. |
CVE-2019-15769 | High | 8.8 | 2019-08-29 | The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option. |
CVE-2019-10057 | Medium | 6.5 | 2019-08-28 | Various Lexmark products have CSRF. |
CVE-2019-15496 | High | 8.8 | 2019-08-28 | MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrato… |
CVE-2019-10384 | High | 8.8 | 2019-08-28 | Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did… |
CVE-2019-11457 | High | 8.8 | 2019-08-27 | Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /co… |
CVE-2019-15660 | High | 8.8 | 2019-08-27 | The wp-members plugin before 3.2.8 for WordPress has CSRF. |
CVE-2019-15648 | Medium | 6.5 | 2019-08-27 | The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber. |
CVE-2019-15645 | High | 8.8 | 2019-08-27 | The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF. |
CVE-2018-21006 | High | 8.8 | 2019-08-27 | The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF. |
CVE-2018-21002 | High | 8.8 | 2019-08-27 | The js-support-ticket plugin before 2.0.6 for WordPress has CSRF. |
CVE-2015-9343 | High | 8.8 | 2019-08-27 | The wp-rollback plugin before 1.2.3 for WordPress has CSRF. |
CVE-2019-15515 | Medium | 6.5 | 2019-08-26 | Discourse 2.3.2 sends the CSRF token in the query string. |
CVE-2019-8447 | Medium | 4.3 | 2019-08-23 | The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSR… |
CVE-2019-14999 | Medium | 4.3 | 2019-08-23 | The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before… |
CVE-2019-11588 | Medium | 4.3 | 2019-08-23 | The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before versi… |
CVE-2019-11587 | Medium | 6.5 | 2019-08-23 | Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before versio… |
CVE-2019-11586 | Medium | 4.3 | 2019-08-23 | The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remo… |
CVE-2019-15491 | High | 8.8 | 2019-08-23 | openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21. |
CVE-2019-15329 | High | 8.8 | 2019-08-22 | The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF. |
CVE-2014-10382 | Medium | 4.3 | 2019-08-22 | The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment. |
CVE-2016-10918 | High | 8.8 | 2019-08-22 | The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF. |
CVE-2019-13477 | High | 8.8 | 2019-08-21 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root accoun… |
CVE-2019-12624 | High | 8.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker… |
CVE-2017-18521 | High | 8.8 | 2019-08-21 | The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n. |
CVE-2016-10903 | High | 8.8 | 2019-08-21 | The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF. |
CVE-2016-10902 | High | 8.8 | 2019-08-21 | The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools. |
CVE-2019-4167 | Medium | 6.5 | 2019-08-20 | IBM StoredIQ 7.6.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a u… |
CVE-2019-4117 | High | 8.8 | 2019-08-20 | IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions trans… |
CVE-2017-18523 | High | 8.8 | 2019-08-20 | The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book. |
CVE-2019-15238 | High | 8.8 | 2019-08-20 | The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field. |
CVE-2017-18569 | High | 8.8 | 2019-08-20 | The my-wp-translate plugin before 1.0.4 for WordPress has CSRF. |
CVE-2016-10915 | High | 8.8 | 2019-08-20 | The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF. |
CVE-2016-10914 | High | 8.8 | 2019-08-20 | The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file. |
CVE-2015-9332 | Medium | 6.5 | 2019-08-20 | The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI. |
CVE-2014-10381 | High | 8.8 | 2019-08-20 | The user-domain-whitelist plugin before 1.5 for WordPress has CSRF. |
CVE-2011-5328 | High | 8.8 | 2019-08-20 | The user-access-manager plugin before 1.2 for WordPress has CSRF. |
CVE-2019-15229 | High | 8.8 | 2019-08-20 | FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into execut… |
CVE-2019-15150 | High | 8.8 | 2019-08-19 | In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback functi… |
CVE-2019-15115 | High | 8.8 | 2019-08-16 | The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF. |
CVE-2019-15114 | High | 8.8 | 2019-08-16 | The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF. |
CVE-2019-15113 | High | 8.8 | 2019-08-16 | The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF. |
CVE-2018-20974 | High | 8.8 | 2019-08-16 | The js-jobs plugin before 1.0.7 for WordPress has CSRF. |
CVE-2018-20972 | High | 8.8 | 2019-08-16 | The companion-auto-update plugin before 3.2.1 for WordPress has CSRF. |
CVE-2018-20971 | High | 8.8 | 2019-08-16 | The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan. |
CVE-2017-18547 | High | 8.8 | 2019-08-16 | The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms. |
CVE-2017-18546 | High | 8.8 | 2019-08-16 | The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF. |
CVE-2017-18544 | High | 8.8 | 2019-08-16 | The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF. |
CVE-2015-9322 | High | 8.8 | 2019-08-16 | The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF. |
CVE-2019-13516 | High | 8.8 | 2019-08-15 | In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not take… |
CVE-2018-14668 | High | 8.8 | 2019-08-15 | In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protoc… |
CVE-2019-15062 | High | 8.0 | 2019-08-14 | An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings pag… |
CVE-2019-14526 | High | 8.1 | 2019-08-14 | An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically… |
CVE-2019-14216 | High | 8.8 | 2019-08-14 | An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mi… |
CVE-2019-10199 | High | 8.8 | 2019-08-14 | It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an… |
CVE-2018-20968 | High | 8.8 | 2019-08-14 | The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF. |
CVE-2018-20967 | High | 8.8 | 2019-08-14 | The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF. |
CVE-2017-18513 | High | 8.8 | 2019-08-14 | The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface. |
CVE-2017-18512 | High | 8.8 | 2019-08-14 | The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF. |
CVE-2017-18511 | High | 8.8 | 2019-08-14 | The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF. |
CVE-2017-18510 | High | 8.8 | 2019-08-14 | The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions. |
CVE-2016-10885 | High | 8.8 | 2019-08-14 | The wp-editor plugin before 1.2.6 for WordPress has CSRF. |
CVE-2016-10884 | High | 8.8 | 2019-08-14 | The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues. |
CVE-2016-10883 | Medium | 6.5 | 2019-08-14 | The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users. |
CVE-2016-10882 | High | 8.8 | 2019-08-14 | The google-document-embedder plugin before 2.6.2 for WordPress has CSRF. |