CWE-352 · Cross-Site Request Forgery (CSRF) (page 80)
Page 80 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-6504 | High | 8.8 | 2018-09-20 | A potential Cross-Site Request Forgery (CSRF) vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulne… |
CVE-2018-13398 | Medium | 6.5 | 2018-09-18 | The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a… |
CVE-2018-16952 | High | 8.8 | 2018-09-18 | The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. The impact is sensitive actions… |
CVE-2018-17104 | High | 8.8 | 2018-09-16 | An issue was discovered in Microweber 1.0.7. There is a CSRF attack (against the admin user) that can add an administrative account via api/save_user. |
CVE-2018-17103 | High | 8.8 | 2018-09-16 | An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The… |
CVE-2018-17102 | High | 8.8 | 2018-09-16 | An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2. A CSRF vulnerability can change the administrator password via the user/me URI. |
CVE-2018-17070 | Medium | 6.5 | 2018-09-15 | An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=… |
CVE-2018-17069 | Medium | 6.5 | 2018-09-15 | An issue was discovered in UNL-CMS 7.59. A CSRF attack can create new content via ?q=node%2Fadd%2Farticle&render=overlay&render=overlay. |
CVE-2018-17045 | High | 8.8 | 2018-09-14 | An issue was discovered in CMS MaeloStore V.1.5.0. There is a CSRF vulnerability that can change the administrator password via admin/modul/users/aksi_users.ph… |
CVE-2018-17023 | High | 8.8 | 2018-09-13 | Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to hijack the authent… |
CVE-2018-16951 | High | 8.0 | 2018-09-12 | xunfeng 0.2.0 allows command execution via CSRF because masscan.py mishandles backquote characters, a related issue to CVE-2018-16832. |
CVE-2018-16832 | Medium | 6.5 | 2018-09-11 | CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite th… |
CVE-2016-7067 | Medium | 6.5 | 2018-09-10 | Monit before version 5.20.0 is vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitor… |
CVE-2018-16732 | High | 8.8 | 2018-09-08 | \upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save. |
CVE-2018-0647 | High | 8.8 | 2018-09-07 | Cross-site request forgery (CSRF) vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authentication of adminis… |
CVE-2018-16650 | High | 8.8 | 2018-09-07 | phpMyFAQ before 2.9.11 allows CSRF. |
CVE-2018-1000669 | High | 8.8 | 2018-09-06 | KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/… |
CVE-2018-16552 | High | 8.8 | 2018-09-05 | MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs. |
CVE-2018-15682 | High | 8.8 | 2018-09-05 | An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to automate the action of sending private mess… |
CVE-2018-15677 | Medium | 6.1 | 2018-09-05 | The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF. |
CVE-2018-14769 | High | 8.8 | 2018-09-05 | VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF. |
CVE-2018-16458 | Medium | 6.5 | 2018-09-04 | An issue was discovered in baigo CMS v2.1.1. There is an index.php?m=article&c=request CSRF that can cause publication of any article. |
CVE-2018-16449 | Medium | 6.5 | 2018-09-04 | OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit… |
CVE-2018-16448 | High | 8.8 | 2018-09-04 | Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/us… |
CVE-2018-16447 | High | 8.8 | 2018-09-04 | Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF. |
CVE-2018-16431 | High | 8.8 | 2018-09-04 | admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account. |
CVE-2018-16416 | High | 8.8 | 2018-09-03 | Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password. |
CVE-2018-16387 | High | 8.8 | 2018-09-03 | An issue was discovered in Elefant CMS before 2.0.5. There is a CSRF vulnerability that can add an account via user/add. |
CVE-2018-16380 | High | 8.8 | 2018-09-03 | An issue was discovered in Ogma CMS 0.4 Beta. There is a CSRF vulnerability in users.php?action=createnew that can add an admin account. |
CVE-2018-16366 | High | 8.8 | 2018-09-02 | An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF. |
CVE-2018-16365 | High | 8.8 | 2018-09-02 | An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF. |
CVE-2018-16345 | High | 8.8 | 2018-09-02 | An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listus… |
CVE-2018-16339 | High | 8.8 | 2018-09-02 | An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser. |
CVE-2018-16338 | High | 8.8 | 2018-09-02 | An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add… |
CVE-2018-16337 | Medium | 6.5 | 2018-09-02 | An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save. |
CVE-2018-16332 | High | 8.8 | 2018-09-02 | An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability. |
CVE-2018-16331 | High | 8.8 | 2018-09-02 | admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password. |
CVE-2018-16315 | Medium | 6.5 | 2018-09-01 | In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add. |
CVE-2018-16314 | High | 8.8 | 2018-09-01 | An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRF_TOKEN, if CSRF_TOKEN does not exist, only the Referer header is validated… |
CVE-2018-11718 | High | 8.8 | 2018-08-30 | Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow CSRF. |
CVE-2018-15121 | High | 8.8 | 2018-08-29 | An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID C… |
CVE-2018-15901 | High | 8.8 | 2018-08-28 | e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators. |
CVE-2018-15884 | High | 8.8 | 2018-08-28 | RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter. |
CVE-2014-6046 | High | 8.8 | 2018-08-28 | Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users f… |
CVE-2018-15851 | High | 8.8 | 2018-08-25 | An issue was discovered in Flexo CMS v0.1.6. There is a CSRF vulnerability that can add an administrator via /admin/user/add. |
CVE-2018-15850 | High | 8.8 | 2018-08-25 | An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user. |
CVE-2018-15849 | Medium | 4.3 | 2018-08-25 | An issue was discovered in portfolioCMS 1.0.5. There is CSRF to update the website settings via admin/aboutus.php. |
CVE-2018-15848 | High | 8.8 | 2018-08-25 | An issue was discovered in portfolioCMS 1.0.5. There is CSRF to create new pages via admin/portfolio.php?newpage=true. |
CVE-2018-15846 | High | 8.8 | 2018-08-25 | An issue was discovered in fledrCMS through 2014-02-03. There is a CSRF vulnerability that can change the administrator's password via index.php?p=done&savedat… |
CVE-2018-15845 | High | 8.8 | 2018-08-25 | There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add. |
CVE-2018-15844 | High | 8.8 | 2018-08-25 | An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit. |
CVE-2018-11502 | Medium | 6.5 | 2018-08-24 | An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. An attacker… |
CVE-2018-10884 | High | 8.8 | 2018-08-22 | Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. An attacker could exploit this b… |
CVE-2018-15569 | Medium | 6.5 | 2018-08-20 | my little forum 2.4.12 allows CSRF for deletion of users. |
CVE-2018-15568 | High | 8.8 | 2018-08-20 | tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html. |
CVE-2018-15565 | High | 8.8 | 2018-08-20 | An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication for adding a page. This can also be ex… |
CVE-2018-15564 | High | 8.8 | 2018-08-20 | An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8. |
CVE-2018-14057 | High | 8.8 | 2018-08-17 | Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSR… |
CVE-2018-1712 | High | 8.6 | 2018-08-16 | IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters… |
CVE-2018-1455 | Medium | 4.3 | 2018-08-15 | IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute maliciou… |
CVE-2018-13394 | Medium | 6.5 | 2018-08-15 | The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed version in… |
CVE-2018-13393 | Medium | 6.5 | 2018-08-15 | The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed… |
CVE-2018-2442 | High | 8.8 | 2018-08-14 | In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details ca… |
CVE-2018-7097 | High | 8.8 | 2018-08-14 | A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited remotely to allow cros… |
CVE-2018-14783 | High | 8.8 | 2018-08-10 | NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. A cross-site request forgery condition can occur, allowing an at… |
CVE-2018-15187 | High | 8.0 | 2018-08-10 | PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php. |
CVE-2018-15186 | High | 8.8 | 2018-08-10 | PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has CSRF via client/auditor/updprofile.php. |
CVE-2018-15203 | Medium | 6.5 | 2018-08-08 | An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/add_page allows a CSRF attack to add pages. |
CVE-2018-15202 | Medium | 6.3 | 2018-08-08 | An issue was discovered in Juunan06 eCommerce through 2018-08-05. There is a CSRF vulnerability in ee/eBoutique/app/template/includes/crudTreatment.php that ca… |
CVE-2018-15198 | High | 8.8 | 2018-08-08 | An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user. |
CVE-2018-15197 | High | 8.8 | 2018-08-08 | An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges. |
CVE-2018-15193 | High | 8.8 | 2018-08-08 | A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link. |
CVE-2018-15177 | High | 8.8 | 2018-08-08 | In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account. |
CVE-2013-7464 | High | 8.8 | 2018-08-08 | In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the… |
CVE-2018-7060 | High | 8.8 | 2018-08-06 | Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authen… |
CVE-2018-14978 | High | 8.8 | 2018-08-06 | An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI. |
CVE-2018-14966 | High | 8.8 | 2018-08-06 | An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=user&do=add page allows CSRF. |
CVE-2018-14965 | High | 8.8 | 2018-08-06 | An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF. |
CVE-2018-14963 | High | 8.8 | 2018-08-06 | zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI. |
CVE-2018-14960 | High | 8.8 | 2018-08-06 | Xiao5uCompany 1.7 has CSRF via admin/Admin.asp. |
CVE-2018-14959 | High | 8.8 | 2018-08-05 | An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI. |
CVE-2018-14958 | High | 8.8 | 2018-08-05 | An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings (such as the theme, title, and description) via index.php. |
CVE-2018-14926 | High | 8.8 | 2018-08-03 | Matera Banco 1.0.0 allows CSRF, as demonstrated by a /contingency/web/messageSend/messageSendHandler.jsp request. |
CVE-2018-14910 | High | 8.8 | 2018-08-03 | SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (aka /adm1n/admin_ip.php). The code is e… |
CVE-2018-14908 | High | 8.8 | 2018-08-03 | Samsung Syncthru Web Service V4.05.61 is vulnerable to CSRF on every request, as demonstrated by sws.application/printinformation/printReportSetupView.sws for… |
CVE-2018-0413 | High | 8.8 | 2018-08-01 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2018-1999027 | High | 7.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows at… |
CVE-2018-14603 | High | 8.8 | 2018-07-27 | An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. CSRF can occur in the Test fe… |
CVE-2018-14583 | High | 8.8 | 2018-07-24 | xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account. |
CVE-2018-14582 | High | 8.8 | 2018-07-24 | index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account. |
CVE-2017-3187 | High | 8.8 | 2018-07-24 | The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery. The dotCMS administrator panel contains a cross-site… |
CVE-2018-14421 | High | 8.8 | 2018-07-20 | SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /backend/admin_video.ph… |
CVE-2018-14420 | High | 8.8 | 2018-07-20 | MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=ad… |
CVE-2018-0402 | High | 8.8 | 2018-07-18 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote att… |
CVE-2018-14331 | High | 8.8 | 2018-07-17 | An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my. |
CVE-2018-14069 | High | 8.8 | 2018-07-15 | An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add a user account via admin.php?m=Admin&c=member&a=add. |
CVE-2018-14068 | High | 8.8 | 2018-07-15 | An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add an admin account via admin.php?m=Admin&c=manager&a=add. |
CVE-2016-6578 | High | 8.8 | 2018-07-13 | CodeLathe FileCloud, version 13.0.0.32841 and earlier, contains a global cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with… |
CVE-2016-6557 | High | 8.8 | 2018-07-13 | In ASUS RP-AC52 access points with firmware version 1.0.1.1s and possibly earlier, the web interface, the web interface does not sufficiently verify whether a… |
CVE-2018-1000206 | High | 8.8 | 2018-07-13 | JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allo… |