CWE-352 · Cross-Site Request Forgery (CSRF) (page 81)
Page 81 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-7216 | High | 8.0 | 2018-02-18 | Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal allows remote authenticated users to hija… |
CVE-2018-7176 | High | 8.8 | 2018-02-16 | FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions pa… |
CVE-2017-5796 | High | 8.8 | 2018-02-15 | A Remote Cross Site Request Forgery (CSRF) vulnerability in HPE 2620 Series Network Switches version RA.15.05.0006 was found. |
CVE-2017-5781 | High | 8.8 | 2018-02-15 | A CSRF vulnerability in HPE Matrix Operating Environment version v7.6 was found. |
CVE-2016-8513 | High | 8.0 | 2018-02-15 | A Cross-Site Request Forgery (CSRF) vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6. |
CVE-2017-9963 | High | 8.1 | 2018-02-12 | A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCAD… |
CVE-2018-6888 | High | 8.0 | 2018-02-12 | An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forgery: using a forged… |
CVE-2018-1000053 | High | 8.8 | 2018-02-09 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation that can result in CSRF causing LimeSur… |
CVE-2017-17552 | High | 8.8 | 2018-02-07 | /LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a byp… |
CVE-2014-5280 | High | 8.8 | 2018-02-06 | boot2docker 1.2 and earlier allows attackers to conduct cross-site request forgery (CSRF) attacks by leveraging Docker daemons enabling TCP connections without… |
CVE-2018-6288 | High | 8.8 | 2018-02-06 | Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1. |
CVE-2018-6656 | Medium | 6.5 | 2018-02-06 | Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories. |
CVE-2018-6467 | High | 8.8 | 2018-02-06 | The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php. |
CVE-2018-6651 | High | 8.8 | 2018-02-05 | In the uncurl_ws_accept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin header validation (accepting an arbitra… |
CVE-2017-9414 | High | 8.8 | 2018-02-05 | Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of u… |
CVE-2015-4179 | High | 8.8 | 2018-02-05 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Codestyling Localization plugin 1.99.30 and earlier for Wordpress. |
CVE-2017-18080 | High | 8.8 | 2018-02-02 | The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forger… |
CVE-2017-18042 | High | 8.8 | 2018-02-02 | The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-si… |
CVE-2014-9502 | High | 8.8 | 2018-02-01 | Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified sub modules in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allow remote… |
CVE-2018-0509 | High | 8.8 | 2018-02-01 | Cross-site request forgery (CSRF) vulnerability in epg search result viewer (kkcald) 0.7.21 and earlier allows an attacker to hijack the authentication of admi… |
CVE-2018-6408 | High | 8.8 | 2018-01-30 | An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. CSRF exists in hy-cgi/user.cgi, as demonstrated by changing an administrator passwor… |
CVE-2018-6391 | High | 8.8 | 2018-01-29 | A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. A remote attacker is able to delete Address Reservation… |
CVE-2017-1000356 | High | 8.8 | 2018-01-29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an acc… |
CVE-2017-4951 | High | 8.8 | 2018-01-29 | VMware AirWatch Console (9.2.x before 9.2.2 and 9.1.x before 9.1.5) contains a Cross Site Request Forgery vulnerability when accessing the App Catalog. An atta… |
CVE-2018-6007 | High | 8.8 | 2018-01-29 | CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket. |
CVE-2018-5720 | High | 8.8 | 2018-01-29 | An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A Cross-site request forgery (CSRF) vulner… |
CVE-2018-6357 | High | 8.8 | 2018-01-27 | The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray para… |
CVE-2017-1000504 | High | 8.1 | 2018-01-24 | A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. Th… |
CVE-2017-1769 | High | 8.8 | 2018-01-24 | IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transm… |
CVE-2018-5976 | High | 8.8 | 2018-01-24 | Cross Site Request Forgery (CSRF) exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modifying the admin password. |
CVE-2018-5969 | High | 8.8 | 2018-01-24 | Cross Site Request Forgery (CSRF) exists in Photography CMS 1.0 via clients/resources/ajax/ajax_new_admin.php, as demonstrated by adding an admin account. |
CVE-2018-1000014 | High | 8.8 | 2018-01-23 | Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing at… |
CVE-2018-1000013 | High | 8.8 | 2018-01-23 | Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to trigg… |
CVE-2018-6009 | High | 8.8 | 2018-01-22 | In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity. |
CVE-2017-18033 | Medium | 6.5 | 2018-01-18 | The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abort an executing external system import v… |
CVE-2018-0107 | High | 8.8 | 2018-01-18 | A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actions on an affected… |
CVE-2018-5329 | High | 8.8 | 2018-01-15 | ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) on /CWEBNET/* authenticated pages. A successful CSRF attack can forc… |
CVE-2018-5673 | High | 8.8 | 2018-01-13 | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php. |
CVE-2018-5669 | High | 8.8 | 2018-01-13 | An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php. |
CVE-2018-5658 | High | 8.8 | 2018-01-13 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php. |
CVE-2018-5656 | High | 8.8 | 2018-01-13 | An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php. |
CVE-2017-16886 | High | 8.8 | 2018-01-12 | The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access t… |
CVE-2016-0335 | High | 8.8 | 2018-01-12 | Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 a… |
CVE-2017-16862 | Medium | 4.3 | 2018-01-12 | The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-sit… |
CVE-2018-5368 | High | 8.8 | 2018-01-12 | The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php. |
CVE-2018-5361 | High | 8.8 | 2018-01-12 | The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php. |
CVE-2012-0699 | High | 8.8 | 2018-01-11 | Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentica… |
CVE-2018-0785 | Medium | 6.5 | 2018-01-10 | ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request… |
CVE-2018-5301 | Medium | 6.5 | 2018-01-08 | Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address boo… |
CVE-2018-5285 | High | 8.8 | 2018-01-08 | The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php. |
CVE-2017-1672 | High | 8.8 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2018-5073 | Medium | 6.8 | 2018-01-03 | Online Ticket Booking has CSRF via admin/movieedit.php. |
CVE-2017-1000479 | High | 8.8 | 2018-01-03 | pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the… |
CVE-2017-1000499 | High | 8.8 | 2018-01-03 | phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform… |
CVE-2017-1000432 | High | 8.0 | 2018-01-02 | Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access |
CVE-2017-17990 | High | 8.8 | 2017-12-30 | Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action. |
CVE-2017-17982 | Medium | 6.8 | 2017-12-30 | PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php. |
CVE-2014-0120 | High | 8.8 | 2017-12-29 | Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for re… |
CVE-2017-17960 | High | 8.8 | 2017-12-28 | PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php. |
CVE-2017-17939 | High | 8.8 | 2017-12-28 | PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php. |
CVE-2017-17936 | High | 8.8 | 2017-12-28 | Vanguard Marketplace Digital Products PHP has CSRF via /search. |
CVE-2017-17930 | High | 8.8 | 2017-12-27 | PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel. |
CVE-2017-17908 | High | 8.8 | 2017-12-27 | PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general. |
CVE-2017-17905 | High | 8.8 | 2017-12-27 | PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php. |
CVE-2017-17903 | High | 8.8 | 2017-12-27 | FS Lynda Clone has CSRF via user/edit_profile, as demonstrated by adding content to the user panel. |
CVE-2017-17894 | High | 8.8 | 2017-12-27 | Readymade Job Site Script has CSRF via the /job URI. |
CVE-2017-17891 | High | 8.8 | 2017-12-27 | Readymade Video Sharing Script has CSRF via user-profile-edit.php. |
CVE-2017-17830 | Medium | 6.8 | 2017-12-21 | Bus Booking Script has CSRF via admin/new_master.php. |
CVE-2017-17827 | High | 8.8 | 2017-12-21 | Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batch_manager&mode=unit. An attacker… |
CVE-2017-5263 | High | 8.0 | 2017-12-20 | Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically imp… |
CVE-2017-1746 | High | 8.8 | 2017-12-20 | IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious an… |
CVE-2017-1631 | High | 8.8 | 2017-12-20 | IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious an… |
CVE-2017-17774 | High | 8.8 | 2017-12-20 | admin/configuration.php in Piwigo 2.9.2 has CSRF. |
CVE-2017-14092 | High | 8.8 | 2017-12-16 | The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an… |
CVE-2017-5264 | High | 8.8 | 2017-12-14 | Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application… |
CVE-2017-14362 | High | 7.3 | 2017-12-13 | Cross-Site Request Forgery vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability could be exploited to allow a… |
CVE-2017-17056 | High | 8.8 | 2017-12-04 | The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'password_change()' function of the Modi… |
CVE-2017-12631 | High | 8.8 | 2017-11-30 | Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnera… |
CVE-2016-10701 | High | 8.8 | 2017-11-28 | In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application. |
CVE-2017-8138 | High | 8.8 | 2017-11-22 | HedEx Earlier than V200R006C00 versions has a cross-site request forgery (CSRF) vulnerability. An attacker could trick a user into accessing a website containi… |
CVE-2017-4928 | High | 7.5 | 2017-11-17 | The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injectio… |
CVE-2017-1000224 | Medium | 6.5 | 2017-11-17 | CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin |
CVE-2017-15516 | High | 8.8 | 2017-11-16 | NetApp SnapCenter Server versions 1.1 through 2.x are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability which could be used to cause an unintend… |
CVE-2017-7851 | High | 8.8 | 2017-11-15 | D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of th… |
CVE-2017-11876 | High | 8.8 | 2017-11-15 | Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authoriz… |
CVE-2017-16780 | Critical | 9.8 | 2017-11-10 | The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file. |
CVE-2017-16570 | High | 8.8 | 2017-11-06 | KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In oth… |
CVE-2017-16565 | High | 8.8 | 2017-11-06 | Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authenticate a user via the login screen using th… |
CVE-2017-16563 | High | 8.0 | 2017-11-06 | Cross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream) HT802 devices allows attackers to modify settings, related to cgi-bin/up… |
CVE-2017-1000147 | Medium | 6.8 | 2017-11-03 | Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery (CSRF) attack on the uploader co… |
CVE-2017-1300 | High | 8.8 | 2017-11-01 | IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2017-1000244 | High | 8.8 | 2017-11-01 | Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification |
CVE-2017-16244 | High | 8.8 | 2017-11-01 | Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker t… |
CVE-2015-5170 | High | 8.8 | 2017-10-24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct c… |
CVE-2015-2878 | High | 8.8 | 2017-10-23 | Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators… |
CVE-2012-4568 | High | 8.8 | 2017-10-23 | Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to hijack the authentication of unsp… |
CVE-2017-15808 | High | 8.8 | 2017-10-23 | In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. |
CVE-2017-15735 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. |
CVE-2017-15734 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. |
CVE-2017-15733 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php. |