CWE-352 · Cross-Site Request Forgery (CSRF) (page 79)
Page 79 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-0413 | High | 8.8 | 2018-08-01 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2018-1999027 | High | 7.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows at… |
CVE-2018-14603 | High | 8.8 | 2018-07-27 | An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. CSRF can occur in the Test fe… |
CVE-2018-14583 | High | 8.8 | 2018-07-24 | xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account. |
CVE-2018-14582 | High | 8.8 | 2018-07-24 | index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account. |
CVE-2017-3187 | High | 8.8 | 2018-07-24 | The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery. The dotCMS administrator panel contains a cross-site… |
CVE-2018-14421 | High | 8.8 | 2018-07-20 | SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /backend/admin_video.ph… |
CVE-2018-14420 | High | 8.8 | 2018-07-20 | MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=ad… |
CVE-2018-0402 | High | 8.8 | 2018-07-18 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote att… |
CVE-2018-14331 | High | 8.8 | 2018-07-17 | An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my. |
CVE-2018-14069 | High | 8.8 | 2018-07-15 | An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add a user account via admin.php?m=Admin&c=member&a=add. |
CVE-2018-14068 | High | 8.8 | 2018-07-15 | An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add an admin account via admin.php?m=Admin&c=manager&a=add. |
CVE-2016-6578 | High | 8.8 | 2018-07-13 | CodeLathe FileCloud, version 13.0.0.32841 and earlier, contains a global cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with… |
CVE-2016-6557 | High | 8.8 | 2018-07-13 | In ASUS RP-AC52 access points with firmware version 1.0.1.1s and possibly earlier, the web interface, the web interface does not sufficiently verify whether a… |
CVE-2018-1000206 | High | 8.8 | 2018-07-13 | JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allo… |
CVE-2018-14029 | High | 8.8 | 2018-07-13 | CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's em… |
CVE-2018-14014 | High | 8.8 | 2018-07-12 | In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd. |
CVE-2018-12540 | High | 8.8 | 2018-07-12 | In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allo… |
CVE-2018-10895 | Critical | 9.3 | 2018-07-12 | qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A malicious website could e… |
CVE-2018-10232 | Medium | 6.5 | 2018-07-11 | Cross-site request forgery (CSRF) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to hijack the authent… |
CVE-2018-13989 | High | 8.8 | 2018-07-11 | Grundig Smart Inter@ctive TV 3.0 devices allow CSRF attacks via a POST request to TCP port 8085 containing a predictable ID value, as demonstrated by a /sendrc… |
CVE-2018-13793 | High | 8.8 | 2018-07-09 | Multiple Cross Site Request Forgery (CSRF) vulnerabilities in the HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 exist in Web Verification, Web Sc… |
CVE-2018-13445 | High | 8.8 | 2018-07-08 | An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/admin_manager.php?action=add. |
CVE-2018-13444 | High | 8.8 | 2018-07-08 | An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/admin_manager.php?action=save&id=2. |
CVE-2018-11349 | High | 8.8 | 2018-07-07 | The administration panel of Jirafeau before 3.4.1 is vulnerable to three CSRF attacks on search functionalities: search_by_name, search_by_hash, and search_lin… |
CVE-2018-13407 | Medium | 4.9 | 2018-07-06 | A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated requests and could be abu… |
CVE-2018-13340 | High | 8.8 | 2018-07-05 | Gleez CMS 1.2.0 has CSRF, as demonstrated by a /page/add request. |
CVE-2018-13031 | High | 8.8 | 2018-07-05 | DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account. |
CVE-2018-12739 | High | 8.8 | 2018-07-05 | In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266. |
CVE-2016-10522 | High | 8.8 | 2018-07-05 | rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an a… |
CVE-2018-11636 | High | 8.8 | 2018-07-03 | Cross-site request forgery (CSRF) vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to execute malicio… |
CVE-2018-13067 | High | 8.8 | 2018-07-02 | /upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password. |
CVE-2018-12574 | High | 8.8 | 2018-07-02 | CSRF exists for all actions in the web interface on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices. |
CVE-2018-12529 | High | 8.8 | 2018-07-02 | An issue was discovered on Intex N150 devices. The router firmware suffers from multiple CSRF injection point vulnerabilities including changing user passwords… |
CVE-2018-13040 | High | 8.8 | 2018-07-01 | OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account (at the admin level) via the index.php/man_user/insert URI. |
CVE-2018-13032 | High | 8.8 | 2018-07-01 | ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/pl_web.cgi/util_configlogin_act URI. |
CVE-2018-13010 | High | 8.8 | 2018-06-29 | WSTMall v1.9.1_170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account. |
CVE-2018-12971 | Medium | 6.5 | 2018-06-29 | EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users. |
CVE-2018-11448 | Medium | 4.8 | 2018-06-26 | A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a stored Cross-Site Scripting (XSS) attack i… |
CVE-2018-11447 | High | 8.8 | 2018-06-26 | A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a Cross-Site Request Forgery (CSRF) attack i… |
CVE-2018-1000514 | Medium | 4.3 | 2018-06-26 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes. This v… |
CVE-2018-1000507 | Medium | 6.5 | 2018-06-26 | WP User Groups version 2.0.0 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in allows anybody to modify user groups… |
CVE-2018-1000506 | High | 8.8 | 2018-06-26 | Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-m… |
CVE-2018-1000505 | Medium | 6.5 | 2018-06-26 | Tooltipy (tooltips for WP) version 5 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in could allow anybody to dupli… |
CVE-2018-12603 | High | 8.8 | 2018-06-25 | Cross-site request forgery (CSRF) vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for reque… |
CVE-2018-12602 | High | 8.8 | 2018-06-25 | A CSRF vulnerability exists in LFCMS 3.7.0: users can be added arbitrarily. |
CVE-2018-12659 | High | 8.8 | 2018-06-22 | SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrf_token parameter. |
CVE-2018-0365 | High | 8.8 | 2018-06-21 | A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2018-0364 | High | 8.8 | 2018-06-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to conduct… |
CVE-2018-0363 | High | 8.8 | 2018-06-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (formerly CUPS) could allow an unauthentica… |
CVE-2018-6563 | High | 8.8 | 2018-06-20 | Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authent… |
CVE-2018-12583 | Medium | 6.5 | 2018-06-19 | An issue was discovered in AKCMS 6.1. CSRF can delete an article via an admincp deleteitem action to index.php. |
CVE-2018-12582 | High | 8.8 | 2018-06-19 | An issue was discovered in AKCMS 6.1. CSRF can add an admin account via a /index.php?file=account&action=manageaccounts&job=newaccount URI. |
CVE-2018-6497 | High | 8.8 | 2018-06-16 | Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Server version DDM Content Pack V 10.20, 10.21, 10.22, 10.22 CUP7, 10.30, 10.31… |
CVE-2018-6496 | High | 8.8 | 2018-06-16 | Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow fo… |
CVE-2018-12114 | High | 8.8 | 2018-06-14 | Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts. |
CVE-2018-12354 | High | 8.8 | 2018-06-13 | Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request. |
CVE-2018-11406 | High | 8.8 | 2018-06-13 | An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x befo… |
CVE-2017-5394 | High | 8.8 | 2018-06-11 | A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due to a series of JavaScript events combine… |
CVE-2014-0594 | High | 8.8 | 2018-06-08 | In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's… |
CVE-2018-8925 | High | 8.8 | 2018-06-08 | Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hi… |
CVE-2018-1514 | Medium | 4.3 | 2018-06-07 | IBM Robotic Process Automation with Automation Anywhere 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and… |
CVE-2017-7906 | High | 8.8 | 2018-06-06 | In ABB IP GATEWAY 3.39 and prior, the web server does not sufficiently verify that a request was performed by the authenticated user, which may allow an attack… |
CVE-2018-1000195 | Medium | 4.3 | 2018-06-05 | A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Over… |
CVE-2017-7635 | High | 8.8 | 2018-06-05 | QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections. |
CVE-2018-1432 | Medium | 6.1 | 2018-06-05 | IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame scripting which is a vulnerability that allows an attacker to load Inf… |
CVE-2018-11680 | Medium | 6.5 | 2018-06-02 | An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability in the rich text editor that can add an IFRAME element. This might be used in a… |
CVE-2018-11679 | High | 8.8 | 2018-06-02 | An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability that can add an article via /index.php?case=table&act=add&table=archive&admin_di… |
CVE-2018-11538 | High | 8.8 | 2018-06-01 | servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass. |
CVE-2018-11671 | High | 8.8 | 2018-06-01 | An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle. |
CVE-2018-11670 | High | 8.8 | 2018-06-01 | An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to i… |
CVE-2018-11633 | Medium | 6.5 | 2018-05-31 | An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL c… |
CVE-2018-11632 | Medium | 6.5 | 2018-05-31 | An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into… |
CVE-2016-10529 | High | 8.8 | 2018-05-31 | Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can sen… |
CVE-2015-7610 | High | 8.8 | 2018-05-30 | Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, a… |
CVE-2018-11527 | High | 8.8 | 2018-05-29 | An issue was discovered in CScms v4.1. A Cross-site request forgery (CSRF) vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the adm… |
CVE-2018-11501 | High | 8.8 | 2018-05-26 | PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via user_submit.php?upd=2, with resultant XSS. |
CVE-2018-11500 | High | 8.8 | 2018-05-26 | An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" th… |
CVE-2018-11493 | High | 8.8 | 2018-05-26 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a friendship link via index.php?m=link&f=index&v=add. |
CVE-2017-9641 | High | 8.8 | 2018-05-25 | PI Coresight 2016 R2 contains a cross-site request forgery vulnerability that may allow access to the PI system. OSIsoft recommends that users upgrade to PI Vi… |
CVE-2018-11445 | High | 8.8 | 2018-05-25 | A CSRF issue was discovered on the User Add/System Settings Page (system-settings-user-new2.php) in EasyService Billing 1.0. A User can be added with the Admin… |
CVE-2018-11442 | High | 8.8 | 2018-05-25 | A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= URI, as demonstrated by adding a new quo… |
CVE-2018-11405 | High | 8.8 | 2018-05-24 | Kliqqi 2.0.2 has CSRF in admin/admin_users.php. |
CVE-2018-11371 | High | 8.8 | 2018-05-22 | SkyCaiji 1.2 allows CSRF to add an Administrator user. |
CVE-2018-11096 | Medium | 6.5 | 2018-05-21 | Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the target's account information remotely. |
CVE-2018-11092 | Medium | 6.5 | 2018-05-21 | An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (… |
CVE-2018-1434 | High | 8.8 | 2018-05-17 | IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7… |
CVE-2018-0270 | High | 8.8 | 2018-05-17 | A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to conduct… |
CVE-2017-2613 | Medium | 5.4 | 2018-05-15 | jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most… |
CVE-2018-11127 | Medium | 6.5 | 2018-05-15 | e107 2.1.7 has CSRF resulting in arbitrary user deletion. |
CVE-2018-11126 | High | 8.8 | 2018-05-15 | dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account. |
CVE-2017-12126 | High | 8.8 | 2018-05-14 | An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP pa… |
CVE-2018-11018 | High | 8.8 | 2018-05-13 | An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery (CSRF) vulnerability in apps/admin/controller/system/RoleController.php allows remote at… |
CVE-2018-11004 | High | 8.8 | 2018-05-12 | An issue was discovered in SDcms v1.5. Cross-site request forgery (CSRF) vulnerability in /WWW//app/admin/controller/admincontroller.php allows remote attacker… |
CVE-2018-11003 | Medium | 6.5 | 2018-05-12 | An issue was discovered in YXcms 1.4.7. Cross-site request forgery (CSRF) vulnerability in protected/apps/admin/controller/adminController.php allows remote at… |
CVE-2018-6458 | High | 8.8 | 2018-05-11 | Easy Hosting Control Panel (EHCP) v0.37.12.b allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection. |
CVE-2018-6023 | High | 8.8 | 2018-05-11 | Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi activating, etc. |
CVE-2018-10803 | Medium | 6.1 | 2018-05-10 | Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows… |
CVE-2018-10957 | High | 8.8 | 2018-05-10 | CSRF exists on D-Link DIR-868L devices, leading to (for example) a change to the Admin password. hedwig.cgi and pigwidgeon.cgi are two of the affected componen… |
CVE-2018-10806 | Medium | 5.4 | 2018-05-08 | An issue was discovered in Frog CMS 0.9.5. There is a reflected Cross Site Scripting Vulnerability via the file[current_name] parameter to the admin/?/plugin/f… |