CWE-352 · Cross-Site Request Forgery (CSRF) (page 80)
Page 80 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-10758 | Medium | 6.5 | 2018-05-05 | The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles. |
CVE-2018-10166 | High | 8.8 | 2018-05-03 | The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows does not have Anti-CSRF tokens in any form… |
CVE-2013-0185 | High | 8.8 | 2018-05-01 | Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the authentication of use… |
CVE-2018-10554 | Medium | 5.4 | 2018-04-30 | An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, r… |
CVE-2018-10503 | High | 8.8 | 2018-04-27 | An issue was discovered in index.php in baijiacms V4 v4_1_4_20170105. CSRF allows adding an administrator account via op=edituser, changing the administrator p… |
CVE-2018-1479 | High | 8.8 | 2018-04-27 | IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmi… |
CVE-2018-10312 | High | 8.8 | 2018-04-24 | index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member. |
CVE-2018-10233 | High | 8.8 | 2018-04-23 | The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural… |
CVE-2018-10295 | High | 8.8 | 2018-04-22 | ChemCMS v1.0.6 has CSRF by using public/admin/user/addpost.html to add an administrator account. |
CVE-2018-10267 | High | 8.8 | 2018-04-22 | WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=add_post URI. |
CVE-2018-10266 | High | 8.8 | 2018-04-22 | BEESCMS 4.0 has a CSRF vulnerability to add an administrator account via the admin/admin_admin.php?nav=list_admin_user&admin_p_nav=user URI. |
CVE-2018-10265 | High | 8.8 | 2018-04-22 | An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI. |
CVE-2018-10249 | High | 8.8 | 2018-04-20 | baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account. |
CVE-2018-10248 | Medium | 6.5 | 2018-04-20 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can delete any article via index.php?m=content&f=content&v=recycle_delete. |
CVE-2018-0259 | High | 8.8 | 2018-04-19 | A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cross-site request f… |
CVE-2018-0255 | High | 8.8 | 2018-04-19 | A vulnerability in the device manager web interface of Cisco Industrial Ethernet Switches could allow an unauthenticated, remote attacker to conduct a cross-si… |
CVE-2018-10188 | High | 8.8 | 2018-04-19 | phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libra… |
CVE-2018-10224 | Medium | 6.8 | 2018-04-19 | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html. |
CVE-2018-10223 | Medium | 6.8 | 2018-04-19 | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/admin_manage/add.html. |
CVE-2018-10222 | High | 8.8 | 2018-04-19 | An issue was discovered in idreamsoft iCMS V7.0. There is a CSRF vulnerability that can add a Column via /admincp.php?app=article_category&do=save&frame=iPHP. |
CVE-2018-10185 | High | 8.8 | 2018-04-17 | An issue was discovered in TuziCMS v2.0.6. There is a CSRF vulnerability that can add an admin account, as demonstrated by a history.pushState call. |
CVE-2018-10137 | High | 8.8 | 2018-04-16 | iScripts UberforX 2.2 has CSRF in the "manage_settings" section of the Admin Panel via the /cms?section=manage_settings&action=edit URI. |
CVE-2018-10132 | High | 8.8 | 2018-04-16 | PbootCMS v0.9.8 has CSRF via an admin.php/Message/mod/id/19.html?backurl=/index.php request, resulting in PHP code injection in the recontent parameter. |
CVE-2018-10127 | High | 8.8 | 2018-04-16 | An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser request, resulting in addition of an account with the administrat… |
CVE-2018-10117 | High | 8.8 | 2018-04-16 | An issue was discovered in idreamsoft iCMS V7.0.7. There is a CSRF vulnerability that can add an admin account via admincp.php?app=members&do=save&frame=iPHP. |
CVE-2017-0362 | High | 8.8 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token. |
CVE-2018-6934 | High | 8.8 | 2018-04-12 | CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3. |
CVE-2015-0151 | High | 8.8 | 2018-04-12 | Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to hijack the authentication of… |
CVE-2018-10048 | High | 8.8 | 2018-04-11 | iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel. |
CVE-2018-10031 | High | 8.8 | 2018-04-11 | CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php. |
CVE-2018-10030 | High | 8.8 | 2018-04-11 | CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php. |
CVE-2018-9927 | High | 8.8 | 2018-04-10 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a user account via index.php?m=member&f=index&v=add. |
CVE-2018-9926 | High | 8.8 | 2018-04-10 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add. |
CVE-2018-9923 | High | 8.8 | 2018-04-10 | An issue was discovered in idreamsoft iCMS through 7.0.7. CSRF exists in admincp.php, as demonstrated by adding an article via an app=article&do=save&frame=iPH… |
CVE-2018-9856 | High | 8.8 | 2018-04-09 | Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@… |
CVE-2014-5072 | High | 8.8 | 2018-04-06 | Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication… |
CVE-2014-5034 | High | 8.8 | 2018-04-06 | Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authenticati… |
CVE-2018-1000153 | High | 8.8 | 2018-04-05 | A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java… |
CVE-2018-6874 | High | 8.8 | 2018-04-04 | CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. |
CVE-2018-8814 | Medium | 6.5 | 2018-04-04 | Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication of users for requests that modify plugi… |
CVE-2017-3965 | High | 8.8 | 2018-04-04 | Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows… |
CVE-2018-1098 | High | 8.8 | 2018-04-03 | A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server an… |
CVE-2018-8908 | High | 8.8 | 2018-03-31 | An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML… |
CVE-2018-8893 | High | 8.8 | 2018-03-31 | Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code. |
CVE-2018-9134 | High | 8.8 | 2018-03-30 | file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file und… |
CVE-2015-2009 | High | 8.8 | 2018-03-29 | Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patc… |
CVE-2018-9108 | High | 8.8 | 2018-03-28 | CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges. |
CVE-2018-9092 | High | 8.8 | 2018-03-27 | There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password. |
CVE-2018-7700 | High | 8.8 | 2018-03-27 | DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in… |
CVE-2018-8764 | High | 8.8 | 2018-03-27 | Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 places a CSRF token in the sec_token parameter of a URI, which makes it easier for remote att… |
CVE-2018-8718 | High | 8.0 | 2018-03-27 | Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an a… |
CVE-2018-1213 | High | 8.8 | 2018-03-26 | Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 and 8.1.0.2 is affec… |
CVE-2018-8979 | High | 8.8 | 2018-03-25 | Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI. |
CVE-2018-8817 | High | 8.8 | 2018-03-25 | Wampserver before 3.1.3 has CSRF in add_vhost.php. |
CVE-2018-8972 | High | 8.8 | 2018-03-24 | Creditwest Bank CMS Project (aka CWCMS) through 2017-07-28 has CSRF in the functionality for updating the site configuration, which allows remote attackers to… |
CVE-2018-1000137 | High | 8.8 | 2018-03-23 | I, Librarian version 4.8 and earlier contains a Cross site Request Forgery (CSRF) vulnerability in users.php that can result in the password of the admin being… |
CVE-2018-7524 | High | 8.8 | 2018-03-22 | A cross-site request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras… |
CVE-2017-0933 | High | 8.0 | 2018-03-22 | Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability. An attacker with access to an operator (read-on… |
CVE-2018-1230 | High | 8.8 | 2018-03-21 | Pivotal Spring Batch Admin, all versions, does not contain cross site request forgery protection. A remote unauthenticated user could craft a malicious site th… |
CVE-2014-1457 | High | 8.8 | 2018-03-20 | Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF protection mechanis… |
CVE-2018-8811 | High | 8.8 | 2018-03-20 | Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authen… |
CVE-2014-2675 | Medium | 6.5 | 2018-03-19 | Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers to hijack the auth… |
CVE-2014-2550 | High | 8.8 | 2018-03-19 | Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication… |
CVE-2014-2274 | High | 8.8 | 2018-03-19 | Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the… |
CVE-2014-4613 | Medium | 6.5 | 2018-03-16 | Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of admi… |
CVE-2018-6224 | High | 8.8 | 2018-03-15 | A lack of cross-site request forgery (CSRF) protection vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to submit authenticate… |
CVE-2018-8717 | High | 8.8 | 2018-03-15 | joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager request. |
CVE-2018-7701 | Medium | 6.5 | 2018-03-15 | Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitr… |
CVE-2018-7677 | Low | 3.5 | 2018-03-14 | A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component. |
CVE-2018-1000093 | High | 8.8 | 2018-03-13 | CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the walletd and the simplewal… |
CVE-2018-1000092 | High | 8.8 | 2018-03-13 | CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found… |
CVE-2018-1000086 | High | 8.8 | 2018-03-13 | NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function. h… |
CVE-2018-1000082 | High | 8.8 | 2018-03-13 | Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to manage the server. that c… |
CVE-2016-0272 | High | 8.0 | 2018-03-09 | Cross-site request forgery (CSRF) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp001… |
CVE-2018-1442 | Medium | 4.3 | 2018-03-08 | IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.4) is vulnerable to cross-site request forgery which could allow an… |
CVE-2017-7641 | High | 8.8 | 2018-03-08 | QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections. |
CVE-2018-0216 | Medium | 5.4 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2018-0215 | Medium | 6.3 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2018-0210 | High | 8.8 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2018-7565 | High | 8.8 | 2018-03-07 | CSRF exists on Polycom QDX 6000 devices. |
CVE-2018-7746 | High | 8.8 | 2018-03-07 | An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/channel/modifychannel. For example, with a c… |
CVE-2018-7720 | High | 8.8 | 2018-03-07 | A cross-site request forgery (CSRF) vulnerability exists in Western Bridge Cobub Razor 0.7.2 via /index.php?/user/createNewUser/, resulting in account creation. |
CVE-2017-11649 | High | 8.8 | 2018-03-07 | Cross-site request forgery (CSRF) vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0_RC3 build r6594 allows remote attackers to hijack the authe… |
CVE-2018-7733 | High | 8.8 | 2018-03-06 | An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/add_po… |
CVE-2018-7724 | Medium | 5.4 | 2018-03-06 | The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. CSRF exploitation, related to CV… |
CVE-2018-7307 | High | 8.8 | 2018-03-06 | The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter. |
CVE-2018-7634 | High | 8.8 | 2018-03-01 | An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it possible to abuse the functionality by… |
CVE-2018-7590 | High | 8.8 | 2018-03-01 | CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation. |
CVE-2016-0295 | High | 8.8 | 2018-02-28 | Cross-site request forgery (CSRF) vulnerability in the IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 before 9.5.2 allows remote attackers to hijack the authentica… |
CVE-2018-0520 | High | 8.8 | 2018-02-23 | Cross-site request forgery (CSRF) vulnerability in FS010W firmware FS010W_00_V1.3.0 and earlier allows an attacker to hijack the authentication of administrato… |
CVE-2018-0148 | High | 8.8 | 2018-02-22 | A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) Supervisor Software could… |
CVE-2018-0146 | Medium | 5.4 | 2018-02-22 | A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-site request forger… |
CVE-2018-7308 | High | 8.8 | 2018-02-21 | A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modify any files in any… |
CVE-2018-7305 | Medium | 4.9 | 2018-02-21 | MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts. |
CVE-2016-0348 | High | 8.0 | 2018-02-21 | Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows remote attackers to hijack the authentica… |
CVE-2017-12415 | High | 7.5 | 2018-02-20 | OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10 (legacy), Enterprise Edition before 6… |
CVE-2018-6941 | High | 8.8 | 2018-02-20 | A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XS… |
CVE-2018-6940 | Medium | 6.1 | 2018-02-20 | A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSR… |
CVE-2018-7219 | High | 8.8 | 2018-02-19 | application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/adm… |
CVE-2017-16756 | High | 8.8 | 2018-02-19 | An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.ch… |