CWE-352 · Cross-Site Request Forgery (CSRF) (page 77)
Page 77 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1000414 | High | 8.1 | 2019-01-09 | A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction… |
CVE-2018-1000411 | Medium | 6.5 | 2019-01-09 | A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test res… |
CVE-2018-20613 | High | 8.8 | 2018-12-30 | TEMMOKU T1.09 Beta allows admin/user/add CSRF. |
CVE-2018-20612 | High | 8.8 | 2018-12-30 | UWA 2.3.11 allows index.php?g=admin&c=admin&a=add_admin_do CSRF. |
CVE-2018-20603 | High | 8.8 | 2018-12-30 | Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF. |
CVE-2018-20598 | High | 8.8 | 2018-12-30 | UCMS 1.4.7 has ?do=user_addpost CSRF. |
CVE-2018-20595 | High | 8.8 | 2018-12-30 | A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not… |
CVE-2018-20577 | Critical | 9.1 | 2018-12-28 | Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewall_SPI.exe, cgi-bin/setup_remote_mgmt.exe, cgi-bin/setup_pass.exe, and cgi-bin/upgra… |
CVE-2018-20576 | Medium | 5.4 | 2018-12-28 | Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phone_test.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-s… |
CVE-2018-18696 | High | 8.8 | 2018-12-28 | main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF attack has been prov… |
CVE-2018-15334 | Medium | 4.3 | 2018-12-28 | A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to log out and require… |
CVE-2018-19182 | High | 8.8 | 2018-12-26 | Engelsystem before commit hash 2e28336 allows CSRF. |
CVE-2018-20419 | High | 8.8 | 2018-12-24 | DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account. |
CVE-2018-8892 | Medium | 6.5 | 2018-12-20 | A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modi… |
CVE-2018-1000858 | High | 8.8 | 2018-12-20 | GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Dis… |
CVE-2018-1000846 | High | 8.8 | 2018-12-20 | FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery (CSRF) vulnerability in All (authenticated) API calls in index.php / class.manager.php… |
CVE-2018-1000843 | High | 8.8 | 2018-12-20 | Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Reque… |
CVE-2018-1661 | Medium | 6.5 | 2018-12-20 | IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2018-20231 | High | 8.8 | 2018-12-19 | Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable… |
CVE-2018-20228 | High | 8.0 | 2018-12-19 | Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF. |
CVE-2018-19829 | Medium | 6.5 | 2018-12-18 | Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known. |
CVE-2018-18921 | Medium | 6.5 | 2018-12-18 | PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action. |
CVE-2018-20188 | High | 8.8 | 2018-12-17 | FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account. |
CVE-2018-18246 | Medium | 6.5 | 2018-12-17 | Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenabl… |
CVE-2018-1926 | Medium | 4.3 | 2018-12-12 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-suppli… |
CVE-2018-19969 | High | 8.8 | 2018-12-11 | phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible t… |
CVE-2018-20015 | High | 8.8 | 2018-12-10 | YzmCMS v5.2 has admin/role/add.html CSRF. |
CVE-2018-19923 | High | 8.8 | 2018-12-06 | An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is member/member_email.php?action=edit CSRF. |
CVE-2018-19911 | High | 7.5 | 2018-12-06 | FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_sys… |
CVE-2018-1002103 | High | 8.1 | 2018-12-05 | In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to p… |
CVE-2018-16634 | High | 8.8 | 2018-12-04 | Pluck v4.7.7 allows CSRF via admin.php?action=settings. |
CVE-2018-7831 | High | 8.8 | 2018-11-30 | An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium… |
CVE-2018-1927 | Medium | 6.5 | 2018-11-30 | IBM StoredIQ 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a use… |
CVE-2018-19621 | Medium | 6.5 | 2018-11-28 | server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team. |
CVE-2018-14892 | High | 8.8 | 2018-11-27 | Missing protections against Cross-Site Request Forgery in the web application in ZyXEL NSA325 V2 version 4.81 allow attackers to perform state-changing actions… |
CVE-2018-16854 | Medium | 6.5 | 2018-11-26 | A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent… |
CVE-2018-19561 | High | 8.8 | 2018-11-26 | sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account. |
CVE-2018-19560 | High | 8.8 | 2018-11-26 | BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account. |
CVE-2018-19555 | High | 8.8 | 2018-11-26 | tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password. |
CVE-2018-19546 | High | 8.8 | 2018-11-26 | JTBC(PHP) 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter. |
CVE-2018-19545 | High | 8.8 | 2018-11-26 | JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user. |
CVE-2018-19544 | Medium | 6.5 | 2018-11-26 | JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news. |
CVE-2018-19376 | Medium | 6.5 | 2018-11-20 | An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to delete a log file via the index.php?m=admin&c=data&a=clea… |
CVE-2018-18773 | High | 8.8 | 2018-11-20 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password. |
CVE-2018-18772 | High | 8.8 | 2018-11-20 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS… |
CVE-2018-19335 | Medium | 5.3 | 2018-11-20 | Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download ti… |
CVE-2018-19334 | Medium | 5.3 | 2018-11-20 | Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download ti… |
CVE-2018-10099 | Medium | 5.3 | 2018-11-20 | Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download ti… |
CVE-2018-19332 | High | 8.8 | 2018-11-17 | An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI. |
CVE-2018-19327 | High | 8.8 | 2018-11-17 | An issue was discovered in JTBC(PHP) 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF. |
CVE-2018-19319 | Medium | 6.5 | 2018-11-16 | SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges. |
CVE-2018-19318 | High | 8.8 | 2018-11-16 | SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account. |
CVE-2018-18799 | High | 8.8 | 2018-11-16 | School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos. |
CVE-2018-18797 | High | 8.8 | 2018-11-16 | School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php. |
CVE-2018-18794 | High | 8.8 | 2018-11-16 | School Event Management System 1.0 allows CSRF via user/controller.php?action=edit. |
CVE-2018-18760 | Medium | 6.5 | 2018-11-16 | RhinOS 3.0 build 1190 allows CSRF. |
CVE-2018-19291 | Medium | 6.5 | 2018-11-15 | An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/ro… |
CVE-2018-12416 | High | 7.1 | 2018-11-13 | The GridServer Broker and GridServer Director components of TIBCO Software Inc.'s TIBCO DataSynapse GridServer Manager contain vulnerabilities which may allow… |
CVE-2018-19225 | High | 8.8 | 2018-11-12 | An issue was discovered in LAOBANCMS 2.0. admin/mima.php has CSRF. |
CVE-2018-19192 | High | 8.8 | 2018-11-12 | An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the data[content] parameter. |
CVE-2018-19135 | High | 8.8 | 2018-11-11 | ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an attacker to perform actions for an admi… |
CVE-2017-17550 | High | 8.8 | 2018-11-10 | ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's… |
CVE-2018-19138 | High | 8.8 | 2018-11-09 | WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI. |
CVE-2018-15445 | Medium | 6.3 | 2018-11-08 | A vulnerability in the web-based management interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to conduct a cros… |
CVE-2018-19104 | High | 8.8 | 2018-11-08 | In BageCMS 3.1.3, upload/index.php has a CSRF vulnerability that can be used to upload arbitrary files and get server privileges. |
CVE-2018-12415 | High | 7.5 | 2018-11-06 | The Central Administration server (emsca) component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edi… |
CVE-2018-12414 | High | 7.5 | 2018-11-06 | The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), and Rendezvous Dae… |
CVE-2018-12413 | High | 7.5 | 2018-11-06 | The Schema repository server (tibschemad) component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Editio… |
CVE-2018-12412 | High | 7.5 | 2018-11-06 | The realm server (tibrealmserver) component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edi… |
CVE-2018-12411 | High | 7.5 | 2018-11-06 | The administrative daemon (tibdgadmind) of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO Acti… |
CVE-2018-18935 | High | 8.8 | 2018-11-05 | An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=component&act=addnew URI, as demonstrated by adding a level=1 account. |
CVE-2018-18934 | Critical | 9.8 | 2018-11-05 | An issue was discovered in PopojiCMS v2.0.1. admin_component.php is exploitable via the po-admin/route.php?mod=component&act=addnew URI by using the fupload pa… |
CVE-2018-6907 | High | 8.8 | 2018-11-01 | A Cross Site Request Forgery (CSRF) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allows an attack… |
CVE-2018-18842 | High | 8.8 | 2018-10-30 | CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP code. |
CVE-2018-18742 | High | 8.8 | 2018-10-29 | A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_User.php?Class=add&CF=user URI. |
CVE-2018-18735 | High | 8.8 | 2018-10-29 | A CSRF issue was discovered in admin/Index/tiquan in catfish blog 2.0.33. |
CVE-2018-18734 | High | 8.8 | 2018-10-29 | A CSRF issue was discovered in admin/Index/addmanageuser.html in Catfish CMS 4.8.30. |
CVE-2018-18712 | High | 8.8 | 2018-10-29 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=e… |
CVE-2018-18711 | High | 8.8 | 2018-10-29 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=edi… |
CVE-2018-9281 | High | 8.8 | 2018-10-24 | An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vu… |
CVE-2018-18420 | High | 8.8 | 2018-10-19 | Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=ze… |
CVE-2015-4630 | High | 8.0 | 2018-10-18 | Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20… |
CVE-2018-12370 | High | 8.8 | 2018-10-18 | In Reader View SameSite cookie protections are not checked on exiting. This allows for a payload to be triggered when Reader View is exited if loaded by a mali… |
CVE-2018-12364 | High | 8.8 | 2018-10-18 | NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the targ… |
CVE-2018-15438 | Medium | 6.5 | 2018-10-17 | A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross… |
CVE-2018-15402 | Medium | 5.4 | 2018-10-17 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (… |
CVE-2018-18436 | High | 8.8 | 2018-10-17 | JTBC(PHP) 3.0 allows CSRF for creating an account via the console/account/manage.php?type=action&action=add URI. |
CVE-2018-18432 | High | 8.8 | 2018-10-17 | An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request. |
CVE-2018-18422 | High | 8.8 | 2018-10-17 | UsualToolCMS 8.0 allows CSRF for adding a user account via the cmsadmin/a_adminx.php?x=a URI. |
CVE-2018-15539 | High | 8.8 | 2018-10-15 | Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc. |
CVE-2018-18317 | High | 8.8 | 2018-10-15 | DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI. |
CVE-2018-18316 | High | 8.8 | 2018-10-15 | emlog v6.0.0 has CSRF via the admin/user.php?action=new URI. |
CVE-2018-18215 | High | 8.8 | 2018-10-11 | In youke365 v1.1.5, admin/user.html has a CSRF vulnerability that can add an user account. |
CVE-2018-12456 | High | 8.8 | 2018-10-10 | Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions such as changing t… |
CVE-2018-13800 | High | 7.3 | 2018-10-10 | A vulnerability has been identified in SIMATIC S7-1200 CPU family version 4 (All versions < V4.2.3). The web interface could allow a Cross-Site Request Forgery… |
CVE-2018-18201 | High | 8.8 | 2018-10-09 | qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account. |
CVE-2018-17858 | High | 8.8 | 2018-10-09 | An issue was discovered in Joomla! before 3.8.13. com_installer actions do not have sufficient CSRF hardening in the backend. |
CVE-2018-18191 | High | 8.8 | 2018-10-09 | Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's… |
CVE-2018-2474 | Medium | 6.5 | 2018-10-09 | SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to th… |
CVE-2018-15401 | Medium | 6.5 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an unauthenticated, remote attacker to co… |