CWE-352 · Cross-Site Request Forgery (CSRF) (page 76)
Page 76 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10888 | High | 8.8 | 2019-04-05 | A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html. |
CVE-2018-20816 | Medium | 6.1 | 2019-04-05 | An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session h… |
CVE-2019-10874 | High | 8.8 | 2019-04-05 | Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a Jav… |
CVE-2019-10292 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers to initiate a c… |
CVE-2019-10289 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form valid… |
CVE-2019-10278 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows atta… |
CVE-2019-1003098 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attac… |
CVE-2019-1003092 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers to… |
CVE-2019-1003090 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows at… |
CVE-2019-1003086 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation metho… |
CVE-2019-1003084 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method all… |
CVE-2019-1003082 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers to ini… |
CVE-2019-1003080 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validati… |
CVE-2019-1003078 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method… |
CVE-2019-1003076 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation metho… |
CVE-2019-1003058 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers to initiate… |
CVE-2019-10673 | High | 8.8 | 2019-04-03 | A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and sub… |
CVE-2018-1622 | Medium | 4.3 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious… |
CVE-2019-3876 | Medium | 6.3 | 2019-04-01 | A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Opt… |
CVE-2014-7198 | High | 8.8 | 2019-04-01 | OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protection. |
CVE-2019-10655 | Critical | 9.8 | 2019-03-30 | Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticate… |
CVE-2019-10644 | High | 8.8 | 2019-03-30 | An issue was discovered in HYBBS 2.2. /?admin/user.html has a CSRF vulnerability that can add an administrator account. |
CVE-2019-9604 | High | 8.8 | 2019-03-29 | PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Cross-Site Request Forgery (CSRF) for Edit Profile actions. |
CVE-2019-6607 | Medium | 6.8 | 2019-03-28 | On BIG-IP ASM 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, there is a stored cross-site scripting vulnerability in an ASM… |
CVE-2019-1003046 | Medium | 6.5 | 2019-03-28 | A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an atta… |
CVE-2019-1003044 | High | 7.1 | 2019-03-28 | A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using… |
CVE-2019-10237 | High | 8.8 | 2019-03-27 | S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-… |
CVE-2019-3809 | Medium | 6.5 | 2019-03-25 | A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it sho… |
CVE-2019-1764 | High | 8.1 | 2019-03-22 | A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticat… |
CVE-2019-7440 | Medium | 6.5 | 2019-03-21 | JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi… |
CVE-2019-7433 | High | 8.8 | 2019-03-21 | PHP Scripts Mall Rental Bike Script 2.0.3 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature. |
CVE-2019-7391 | High | 8.8 | 2019-03-21 | ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF. |
CVE-2019-6967 | High | 8.8 | 2019-03-21 | AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF. |
CVE-2019-6282 | High | 8.8 | 2019-03-21 | ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity UR… |
CVE-2018-20648 | High | 8.8 | 2019-03-21 | PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php. |
CVE-2018-20644 | High | 8.8 | 2019-03-21 | PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature. |
CVE-2018-20641 | High | 8.8 | 2019-03-21 | PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature. |
CVE-2018-20633 | High | 8.8 | 2019-03-21 | PHP Scripts Mall Advance B2B Script 2.1.4 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature. |
CVE-2018-19525 | Medium | 6.1 | 2019-03-21 | An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF via /ui/?g=obj_keywords_add and /ui/?g=… |
CVE-2018-19511 | Medium | 6.5 | 2019-03-21 | wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator password. |
CVE-2018-17996 | Medium | 6.5 | 2019-03-21 | LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/del… |
CVE-2018-14575 | High | 8.8 | 2019-03-21 | Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subject. |
CVE-2019-9787 | High | 8.8 | 2019-03-14 | WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occ… |
CVE-2019-9769 | High | 8.8 | 2019-03-14 | PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator. |
CVE-2019-5924 | High | 8.8 | 2019-03-12 | Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a… |
CVE-2019-5920 | High | 8.8 | 2019-03-12 | Cross-site request forgery (CSRF) vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators via a spe… |
CVE-2019-9688 | High | 8.8 | 2019-03-11 | sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=add_post CSRF to add an admin account. |
CVE-2019-9652 | High | 8.8 | 2019-03-11 | There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request. It allows PHP code injection by providing a filename in the file parameter, and providing… |
CVE-2019-9598 | Medium | 6.5 | 2019-03-07 | An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds. |
CVE-2019-8437 | High | 8.8 | 2019-03-07 | njiandan-cms through 2013-05-23 has index.php/admin/user_new CSRF to add an administrator. |
CVE-2019-6710 | High | 8.8 | 2019-03-07 | Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF. |
CVE-2018-18449 | High | 8.8 | 2019-03-07 | EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339. |
CVE-2018-17429 | High | 8.8 | 2019-03-07 | /console/account/manage.php?type=action&action=add in JTBC v3.0(C) has CSRF for adding an administrator account. |
CVE-2019-9625 | High | 8.8 | 2019-03-07 | JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN URI to create a new admin account. |
CVE-2019-9603 | Medium | 6.5 | 2019-03-06 | MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891. |
CVE-2019-6561 | High | 8.8 | 2019-03-05 | Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device. |
CVE-2019-9549 | High | 8.8 | 2019-03-03 | An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a sim… |
CVE-2019-9182 | High | 8.8 | 2019-02-26 | There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request. It allows PHP code injection by providing a filename in the file paramet… |
CVE-2019-9062 | High | 8.0 | 2019-02-23 | PHP Scripts Mall Online Food Ordering Script 1.0 has Cross-Site Request Forgery (CSRF) in my-account.php. |
CVE-2019-9052 | Medium | 6.5 | 2019-02-23 | An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI. |
CVE-2019-9051 | Medium | 6.5 | 2019-02-23 | An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI. |
CVE-2019-9049 | Medium | 6.5 | 2019-02-23 | An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=module_delete&var1= URI. |
CVE-2019-9048 | Medium | 6.5 | 2019-02-23 | An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a theme (aka topic) via a /admin.php?action=theme_delete&var1= URI. |
CVE-2019-9040 | High | 8.8 | 2019-02-23 | S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332. |
CVE-2019-8910 | High | 8.8 | 2019-02-18 | An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=site_post CSRF. |
CVE-2019-8902 | Medium | 5.7 | 2019-02-18 | An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI. |
CVE-2019-0267 | High | 8.8 | 2019-02-15 | SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens. This might lea… |
CVE-2019-8347 | High | 8.8 | 2019-02-15 | BEESCMS 4.0 has a CSRF vulnerability to add arbitrary VIP accounts via the admin/admin_member.php?action=add&nav=add_web_user&admin_p_nav=user URI. |
CVE-2019-7738 | Medium | 6.5 | 2019-02-11 | C.P.Sub before 5.3 allows CSRF via a manage.php?p=article_del&id= URI. |
CVE-2019-7737 | High | 8.8 | 2019-02-11 | A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit. |
CVE-2019-7730 | Medium | 5.7 | 2019-02-11 | MyWebSQL 3.7 has a Cross-site request forgery (CSRF) vulnerability for deleting a database via the /?q=wrkfrm&type=databases URI. |
CVE-2018-20780 | High | 8.8 | 2019-02-11 | Traq 3.7.1 allows admin/users/new CSRF to create an admin account (aka group_id=1). |
CVE-2019-7570 | Medium | 6.5 | 2019-02-07 | A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI. |
CVE-2019-7569 | High | 8.8 | 2019-02-07 | An issue was discovered in DOYO (aka doyocms) 2.3(20140425 update). There is a CSRF vulnerability that can add a super administrator account via admin.php?c=a_… |
CVE-2019-7566 | High | 8.8 | 2019-02-07 | CSZ CMS 1.1.8 has CSRF via admin/users/new/add. |
CVE-2019-1003022 | Medium | 6.5 | 2019-02-06 | A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on th… |
CVE-2019-1003017 | Medium | 5.3 | 2019-02-06 | A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconf… |
CVE-2019-1003016 | High | 8.8 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImp… |
CVE-2019-1003012 | Medium | 6.5 | 2019-02-06 | A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/j… |
CVE-2019-1003010 | Medium | 4.3 | 2019-02-06 | A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows att… |
CVE-2019-1003008 | High | 8.8 | 2019-02-06 | A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/war… |
CVE-2019-1003007 | High | 8.8 | 2019-02-06 | A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that… |
CVE-2019-7402 | Medium | 6.1 | 2019-02-05 | An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg_qqcode parameter. This can be exploited via C… |
CVE-2019-1000022 | High | 8.8 | 2019-02-04 | Taoensso Sente version Prior to version 1.14.0 contains a Cross Site Request Forgery (CSRF) vulnerability in WebSocket handshake endpoint that can result in CS… |
CVE-2019-1000003 | High | 8.8 | 2019-02-04 | MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that c… |
CVE-2019-7346 | High | 8.8 | 2019-02-04 | A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which all… |
CVE-2019-3604 | Medium | 4.8 | 2019-02-01 | Cross-Site Request Forgery (CSRF) vulnerability in McAfee ePO (legacy) Cloud allows unauthenticated users to perform unintended ePO actions using an authentica… |
CVE-2019-6779 | High | 8.1 | 2019-01-24 | Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links. |
CVE-2019-1658 | Medium | 4.7 | 2019-01-24 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2017-17835 | High | 8.8 | 2019-01-23 | In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow. |
CVE-2019-6510 | High | 8.8 | 2019-01-22 | An issue was discovered in creditease-sec insight through 2018-09-11. user_delete in srcpm/app/admin/views.py allows CSRF. |
CVE-2019-6509 | High | 8.8 | 2019-01-22 | An issue was discovered in creditease-sec insight through 2018-09-11. depart_delete in srcpm/app/admin/views.py allows CSRF. |
CVE-2019-6508 | High | 8.8 | 2019-01-22 | An issue was discovered in creditease-sec insight through 2018-09-11. role_perm_delete in srcpm/app/admin/views.py allows CSRF. |
CVE-2019-6507 | High | 8.8 | 2019-01-22 | An issue was discovered in creditease-sec insight through 2018-09-11. login_user_delete in srcpm/app/admin/views.py allows CSRF. |
CVE-2018-20728 | High | 8.8 | 2019-01-17 | A cross site request forgery (CSRF) vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php. |
CVE-2016-10738 | High | 8.8 | 2019-01-16 | Zenbership v107 has CSRF via admin/cp-functions/event-add.php. |
CVE-2019-6294 | High | 8.8 | 2019-01-15 | An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent URI. |
CVE-2019-6249 | High | 8.8 | 2019-01-13 | An issue was discovered in HuCart v5.7.4. There is a CSRF vulnerability that can add an admin account via /adminsys/index.php?load=admins&act=edit_info&act_typ… |
CVE-2019-6244 | High | 8.8 | 2019-01-12 | An issue was discovered in UsualToolCMS 8.0. cmsadmin/a_sqlbackx.php?t=sql allows CSRF attacks that can execute SQL statements, and consequently execute arbitr… |
CVE-2018-1000417 | High | 8.1 | 2019-01-09 | A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows cre… |