CWE-352 · Cross-Site Request Forgery (CSRF) (page 75)
Page 75 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-5630 | Medium | 5.9 | 2019-07-03 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attac… |
CVE-2018-10986 | High | 8.8 | 2019-07-03 | OX Guard 2.8.0 has CSRF. |
CVE-2018-11427 | High | 8.8 | 2019-07-03 | CSRF tokens are not used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior, which makes it possible to perform CSRF… |
CVE-2017-8406 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allow… |
CVE-2017-8407 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web manageme… |
CVE-2019-7262 | High | 8.8 | 2019-07-02 | Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF). |
CVE-2019-7270 | High | 8.8 | 2019-07-02 | Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF). |
CVE-2019-13056 | High | 8.8 | 2019-07-02 | An issue was discovered in CyberPanel through 1.8.4. On the user edit page, an attacker can edit the administrator's e-mail and password because of the lack of… |
CVE-2019-7273 | High | 8.8 | 2019-07-01 | Optergy Proton/Enterprise devices allow Cross-Site Request Forgery (CSRF). |
CVE-2019-7281 | High | 8.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. An unauthenticated user can send unverified HTTP requests, which may allow the attacker to perform certain ac… |
CVE-2019-12826 | High | 8.8 | 2019-07-01 | A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers t… |
CVE-2018-20848 | High | 8.8 | 2019-06-30 | Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie_ajout.php and en/achat/caddie_affichage.php, as demonstrated by an XSS payload in the couleurId[0] par… |
CVE-2019-5814 | Medium | 6.5 | 2019-06-27 | Insufficient policy enforcement in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-6166 | High | 8.8 | 2019-06-26 | A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery. |
CVE-2018-1858 | High | 8.8 | 2019-06-25 | IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2019-9958 | High | 8.8 | 2019-06-24 | CSRF within the admin panel in Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to escalate privileges, or create new admin accounts by c… |
CVE-2019-12836 | High | 8.8 | 2019-06-21 | The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link (to an existing issue) that can cause forgery of a request to an out-of-… |
CVE-2019-1904 | High | 8.8 | 2019-06-21 | A vulnerability in the web-based UI (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (… |
CVE-2019-1874 | High | 8.8 | 2019-06-20 | A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2019-1632 | Medium | 4.6 | 2019-06-20 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct… |
CVE-2018-17387 | High | 8.8 | 2019-06-19 | CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account. |
CVE-2018-17389 | High | 8.8 | 2019-06-19 | CSRF exists in server.php in Live Call Support Application 1.5 for adding an admin account. |
CVE-2017-8334 | High | 8.0 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking… |
CVE-2017-8328 | High | 8.8 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of changing… |
CVE-2018-18802 | High | 8.8 | 2019-06-18 | The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/mod_users/controller.php?action=edit. |
CVE-2019-4142 | High | 8.8 | 2019-06-18 | IBM Cloud Private 2.1.0, 3.1.0, 3.1.1, and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorize… |
CVE-2017-9381 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a user with the capability of installing or deleting apps on… |
CVE-2019-6325 | High | 8.8 | 2019-06-17 | HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an… |
CVE-2019-0996 | Medium | 6.5 | 2019-06-12 | A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery… |
CVE-2019-3410 | Medium | 4.6 | 2019-06-11 | All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fac… |
CVE-2019-10338 | High | 8.8 | 2019-06-11 | A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed attackers to… |
CVE-2019-10331 | Medium | 4.3 | 2019-06-11 | A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attackers to connect to a… |
CVE-2019-11517 | Medium | 6.5 | 2019-06-10 | WampServer before 3.1.9 has CSRF in add_vhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incomplete. An attacker coul… |
CVE-2018-10696 | High | 8.8 | 2019-06-07 | An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a web interface to allow an administrator to manage the device. However, this interf… |
CVE-2019-1881 | Medium | 4.7 | 2019-06-05 | A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a c… |
CVE-2019-12616 | Medium | 6.5 | 2019-06-05 | An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The a… |
CVE-2019-9883 | High | 8.8 | 2019-06-03 | Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cg… |
CVE-2019-9882 | High | 8.8 | 2019-06-03 | Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list… |
CVE-2019-10326 | Medium | 4.3 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds. |
CVE-2019-10324 | Medium | 6.5 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenRe… |
CVE-2019-10321 | Medium | 4.3 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users… |
CVE-2019-12502 | High | 8.8 | 2019-05-31 | There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/access URI. |
CVE-2018-16218 | High | 8.8 | 2019-05-29 | A CSRF (Cross Site Request Forgery) in the web interface of the Yeahlink Ultra-elegant IP Phone SIP-T41P firmware version 66.83.0.35 allows a remote attacker t… |
CVE-2019-12361 | Medium | 6.1 | 2019-05-27 | EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker… |
CVE-2016-10757 | High | 8.8 | 2019-05-24 | In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.ph… |
CVE-2016-10756 | High | 8.8 | 2019-05-24 | Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then… |
CVE-2019-10847 | High | 8.8 | 2019-05-24 | Computrols CBAS 18.0.0 allows Cross-Site Request Forgery. |
CVE-2018-19613 | Medium | 6.5 | 2019-05-24 | Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allow CSRF. |
CVE-2018-7828 | High | 8.8 | 2019-05-22 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera when an authenticated user… |
CVE-2019-12253 | Medium | 6.5 | 2019-05-21 | my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&delete_posting. |
CVE-2019-12239 | High | 7.2 | 2019-05-20 | The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrati… |
CVE-2018-16136 | High | 8.8 | 2019-05-13 | An issue was discovered in the administrator interface in IPBRICK OS 6.3. The application doesn't check for Anti-CSRF tokens, allowing the submission of multip… |
CVE-2018-14711 | Medium | 6.5 | 2019-05-13 | Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to cause state-changing actions with s… |
CVE-2019-11886 | High | 8.8 | 2019-05-13 | The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstra… |
CVE-2018-1790 | Medium | 4.3 | 2019-05-10 | IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to ex… |
CVE-2017-12789 | High | 8.8 | 2019-05-10 | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/interface/online/dele… |
CVE-2017-12790 | Medium | 6.5 | 2019-05-09 | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/index.php. The attack… |
CVE-2019-7746 | High | 8.1 | 2019-05-07 | JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain an admin token by making a /cgi-bin/qcmap_auth type=getuser request and then read… |
CVE-2018-2001 | Medium | 4.3 | 2019-05-07 | IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute maliciou… |
CVE-2018-13993 | High | 8.8 | 2019-05-07 | The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is prone to CSRF. |
CVE-2019-11569 | High | 8.8 | 2019-05-06 | Veeam ONE Reporter 9.5.0.3201 allows CSRF. |
CVE-2018-4066 | High | 8.8 | 2019-05-06 | An exploitable cross-site request forgery vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted H… |
CVE-2019-5431 | Medium | 5.4 | 2019-05-06 | This vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions 3.0 to 3.4.0 is vulnerable to a callback verification flaw in… |
CVE-2019-5430 | High | 8.8 | 2019-05-06 | In UniFi Video 3.10.0 and prior, due to the lack of CSRF protection, it is possible to abuse the Web API to make changes on the server configuration without th… |
CVE-2019-1857 | Medium | 6.1 | 2019-05-03 | A vulnerability in the web-based management interface of Cisco HyperFlex HX-Series could allow an unauthenticated, remote attacker to conduct a cross-site requ… |
CVE-2019-1713 | High | 8.1 | 2019-05-03 | A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to co… |
CVE-2019-11617 | High | 8.8 | 2019-04-30 | doorGets 7.0 has a CSRF vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote attacker can exploit this vulnerability for "Google Ana… |
CVE-2019-11193 | Medium | 6.1 | 2019-04-30 | The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF p… |
CVE-2018-15206 | High | 8.8 | 2019-04-30 | BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf. |
CVE-2018-14930 | High | 8.8 | 2019-04-30 | An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1. CSRF can occur via a /CollatWebApp/gcmsRefInsert?name=SUPP URI. |
CVE-2019-10315 | High | 8.8 | 2019-04-30 | Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF. |
CVE-2019-10310 | High | 8.8 | 2019-04-30 | A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerCo… |
CVE-2019-10307 | Medium | 6.5 | 2019-04-30 | A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handle… |
CVE-2018-5123 | High | 8.8 | 2019-04-29 | A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla… |
CVE-2019-11591 | High | 8.8 | 2019-04-29 | The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion… |
CVE-2019-11590 | High | 8.8 | 2019-04-29 | The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via d… |
CVE-2019-11557 | High | 8.8 | 2019-04-26 | The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file i… |
CVE-2015-9284 | High | 8.8 | 2019-04-26 | The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, al… |
CVE-2019-8991 | High | 8.8 | 2019-04-24 | The administrator web interface of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatri… |
CVE-2019-11203 | Medium | 6.1 | 2019-04-24 | The workspace client, openspace client, app development client, and REST API of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distributi… |
CVE-2019-11456 | High | 8.8 | 2019-04-22 | Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code. |
CVE-2019-11416 | High | 8.8 | 2019-04-22 | A CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of the router, as demonstrated by v1/system/user. |
CVE-2019-11375 | Medium | 6.5 | 2019-04-20 | Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI. |
CVE-2019-11374 | High | 8.8 | 2019-04-20 | 74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI. |
CVE-2019-3718 | High | 8.8 | 2019-04-18 | Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially… |
CVE-2019-10304 | Medium | 6.5 | 2019-04-18 | A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows att… |
CVE-2019-10300 | High | 8.0 | 2019-04-18 | A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method al… |
CVE-2018-17168 | Medium | 6.5 | 2019-04-18 | PrinterOn Enterprise 4.1.4 contains multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page. For example, an administrator, by fo… |
CVE-2019-1797 | High | 8.8 | 2019-04-18 | A vulnerability in the web-based management interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to conduc… |
CVE-2019-1722 | Medium | 6.5 | 2019-04-18 | A vulnerability in the FindMe feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote… |
CVE-2019-10642 | High | 8.8 | 2019-04-17 | Contao 4.7 allows CSRF. |
CVE-2019-9176 | Medium | 6.5 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows CSRF. |
CVE-2018-13810 | Medium | 6.5 | 2019-04-17 | A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated configuration web server of the affected CP devices could… |
CVE-2018-16966 | High | 8.8 | 2019-04-15 | There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter. |
CVE-2018-17584 | High | 8.8 | 2019-04-15 | The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page. |
CVE-2017-18366 | High | 8.8 | 2019-04-15 | Subrion CMS 4.1.5 has CSRF in blog/delete/. |
CVE-2019-11078 | High | 8.8 | 2019-04-11 | MKCMS V5.0 has a CSRF vulnerability to add a new admin user via the ucenter/userinfo.php URI. |
CVE-2019-11077 | High | 8.8 | 2019-04-11 | FastAdmin V1.0.0.20190111_beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI. |
CVE-2019-0229 | High | 8.8 | 2019-04-10 | A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery… |
CVE-2018-2000 | Medium | 4.3 | 2019-04-08 | IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unaut… |