CWE-352 · Cross-Site Request Forgery (CSRF) (page 82)
Page 82 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-0255 | High | 8.8 | 2018-04-19 | A vulnerability in the device manager web interface of Cisco Industrial Ethernet Switches could allow an unauthenticated, remote attacker to conduct a cross-si… |
CVE-2018-10188 | High | 8.8 | 2018-04-19 | phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libra… |
CVE-2018-10224 | Medium | 6.8 | 2018-04-19 | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html. |
CVE-2018-10223 | Medium | 6.8 | 2018-04-19 | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/admin_manage/add.html. |
CVE-2018-10222 | High | 8.8 | 2018-04-19 | An issue was discovered in idreamsoft iCMS V7.0. There is a CSRF vulnerability that can add a Column via /admincp.php?app=article_category&do=save&frame=iPHP. |
CVE-2018-10185 | High | 8.8 | 2018-04-17 | An issue was discovered in TuziCMS v2.0.6. There is a CSRF vulnerability that can add an admin account, as demonstrated by a history.pushState call. |
CVE-2018-10137 | High | 8.8 | 2018-04-16 | iScripts UberforX 2.2 has CSRF in the "manage_settings" section of the Admin Panel via the /cms?section=manage_settings&action=edit URI. |
CVE-2018-10132 | High | 8.8 | 2018-04-16 | PbootCMS v0.9.8 has CSRF via an admin.php/Message/mod/id/19.html?backurl=/index.php request, resulting in PHP code injection in the recontent parameter. |
CVE-2018-10127 | High | 8.8 | 2018-04-16 | An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser request, resulting in addition of an account with the administrat… |
CVE-2018-10117 | High | 8.8 | 2018-04-16 | An issue was discovered in idreamsoft iCMS V7.0.7. There is a CSRF vulnerability that can add an admin account via admincp.php?app=members&do=save&frame=iPHP. |
CVE-2017-0362 | High | 8.8 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token. |
CVE-2018-6934 | High | 8.8 | 2018-04-12 | CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3. |
CVE-2015-0151 | High | 8.8 | 2018-04-12 | Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to hijack the authentication of… |
CVE-2018-10048 | High | 8.8 | 2018-04-11 | iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel. |
CVE-2018-10031 | High | 8.8 | 2018-04-11 | CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php. |
CVE-2018-10030 | High | 8.8 | 2018-04-11 | CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php. |
CVE-2018-9927 | High | 8.8 | 2018-04-10 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a user account via index.php?m=member&f=index&v=add. |
CVE-2018-9926 | High | 8.8 | 2018-04-10 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add. |
CVE-2018-9923 | High | 8.8 | 2018-04-10 | An issue was discovered in idreamsoft iCMS through 7.0.7. CSRF exists in admincp.php, as demonstrated by adding an article via an app=article&do=save&frame=iPH… |
CVE-2018-9856 | High | 8.8 | 2018-04-09 | Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@… |
CVE-2014-5072 | High | 8.8 | 2018-04-06 | Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication… |
CVE-2014-5034 | High | 8.8 | 2018-04-06 | Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authenticati… |
CVE-2018-1000153 | High | 8.8 | 2018-04-05 | A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java… |
CVE-2018-6874 | High | 8.8 | 2018-04-04 | CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. |
CVE-2018-8814 | Medium | 6.5 | 2018-04-04 | Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication of users for requests that modify plugi… |
CVE-2017-3965 | High | 8.8 | 2018-04-04 | Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows… |
CVE-2018-1098 | High | 8.8 | 2018-04-03 | A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server an… |
CVE-2018-8908 | High | 8.8 | 2018-03-31 | An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML… |
CVE-2018-8893 | High | 8.8 | 2018-03-31 | Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code. |
CVE-2018-9134 | High | 8.8 | 2018-03-30 | file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file und… |
CVE-2015-2009 | High | 8.8 | 2018-03-29 | Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patc… |
CVE-2018-9108 | High | 8.8 | 2018-03-28 | CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges. |
CVE-2018-9092 | High | 8.8 | 2018-03-27 | There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password. |
CVE-2018-7700 | High | 8.8 | 2018-03-27 | DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in… |
CVE-2018-8764 | High | 8.8 | 2018-03-27 | Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 places a CSRF token in the sec_token parameter of a URI, which makes it easier for remote att… |
CVE-2018-8718 | High | 8.0 | 2018-03-27 | Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an a… |
CVE-2018-1213 | High | 8.8 | 2018-03-26 | Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 and 8.1.0.2 is affec… |
CVE-2018-8979 | High | 8.8 | 2018-03-25 | Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI. |
CVE-2018-8817 | High | 8.8 | 2018-03-25 | Wampserver before 3.1.3 has CSRF in add_vhost.php. |
CVE-2018-8972 | High | 8.8 | 2018-03-24 | Creditwest Bank CMS Project (aka CWCMS) through 2017-07-28 has CSRF in the functionality for updating the site configuration, which allows remote attackers to… |
CVE-2018-1000137 | High | 8.8 | 2018-03-23 | I, Librarian version 4.8 and earlier contains a Cross site Request Forgery (CSRF) vulnerability in users.php that can result in the password of the admin being… |
CVE-2018-7524 | High | 8.8 | 2018-03-22 | A cross-site request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras… |
CVE-2017-0933 | High | 8.0 | 2018-03-22 | Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability. An attacker with access to an operator (read-on… |
CVE-2018-1230 | High | 8.8 | 2018-03-21 | Pivotal Spring Batch Admin, all versions, does not contain cross site request forgery protection. A remote unauthenticated user could craft a malicious site th… |
CVE-2014-1457 | High | 8.8 | 2018-03-20 | Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF protection mechanis… |
CVE-2018-8811 | High | 8.8 | 2018-03-20 | Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authen… |
CVE-2014-2675 | Medium | 6.5 | 2018-03-19 | Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers to hijack the auth… |
CVE-2014-2550 | High | 8.8 | 2018-03-19 | Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication… |
CVE-2014-2274 | High | 8.8 | 2018-03-19 | Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the… |
CVE-2014-4613 | Medium | 6.5 | 2018-03-16 | Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of admi… |
CVE-2018-6224 | High | 8.8 | 2018-03-15 | A lack of cross-site request forgery (CSRF) protection vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to submit authenticate… |
CVE-2018-8717 | High | 8.8 | 2018-03-15 | joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager request. |
CVE-2018-7701 | Medium | 6.5 | 2018-03-15 | Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitr… |
CVE-2018-7677 | Low | 3.5 | 2018-03-14 | A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component. |
CVE-2018-1000093 | High | 8.8 | 2018-03-13 | CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the walletd and the simplewal… |
CVE-2018-1000092 | High | 8.8 | 2018-03-13 | CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found… |
CVE-2018-1000086 | High | 8.8 | 2018-03-13 | NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function. h… |
CVE-2018-1000082 | High | 8.8 | 2018-03-13 | Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to manage the server. that c… |
CVE-2016-0272 | High | 8.0 | 2018-03-09 | Cross-site request forgery (CSRF) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp001… |
CVE-2018-1442 | Medium | 4.3 | 2018-03-08 | IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.4) is vulnerable to cross-site request forgery which could allow an… |
CVE-2017-7641 | High | 8.8 | 2018-03-08 | QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections. |
CVE-2018-0216 | Medium | 5.4 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2018-0215 | Medium | 6.3 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2018-0210 | High | 8.8 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2018-7565 | High | 8.8 | 2018-03-07 | CSRF exists on Polycom QDX 6000 devices. |
CVE-2018-7746 | High | 8.8 | 2018-03-07 | An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/channel/modifychannel. For example, with a c… |
CVE-2018-7720 | High | 8.8 | 2018-03-07 | A cross-site request forgery (CSRF) vulnerability exists in Western Bridge Cobub Razor 0.7.2 via /index.php?/user/createNewUser/, resulting in account creation. |
CVE-2017-11649 | High | 8.8 | 2018-03-07 | Cross-site request forgery (CSRF) vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0_RC3 build r6594 allows remote attackers to hijack the authe… |
CVE-2018-7733 | High | 8.8 | 2018-03-06 | An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/add_po… |
CVE-2018-7724 | Medium | 5.4 | 2018-03-06 | The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. CSRF exploitation, related to CV… |
CVE-2018-7307 | High | 8.8 | 2018-03-06 | The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter. |
CVE-2018-7634 | High | 8.8 | 2018-03-01 | An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it possible to abuse the functionality by… |
CVE-2018-7590 | High | 8.8 | 2018-03-01 | CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation. |
CVE-2016-0295 | High | 8.8 | 2018-02-28 | Cross-site request forgery (CSRF) vulnerability in the IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 before 9.5.2 allows remote attackers to hijack the authentica… |
CVE-2018-0520 | High | 8.8 | 2018-02-23 | Cross-site request forgery (CSRF) vulnerability in FS010W firmware FS010W_00_V1.3.0 and earlier allows an attacker to hijack the authentication of administrato… |
CVE-2018-0148 | High | 8.8 | 2018-02-22 | A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) Supervisor Software could… |
CVE-2018-0146 | Medium | 5.4 | 2018-02-22 | A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-site request forger… |
CVE-2018-7308 | High | 8.8 | 2018-02-21 | A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modify any files in any… |
CVE-2018-7305 | Medium | 4.9 | 2018-02-21 | MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts. |
CVE-2016-0348 | High | 8.0 | 2018-02-21 | Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows remote attackers to hijack the authentica… |
CVE-2017-12415 | High | 7.5 | 2018-02-20 | OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10 (legacy), Enterprise Edition before 6… |
CVE-2018-6941 | High | 8.8 | 2018-02-20 | A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XS… |
CVE-2018-6940 | Medium | 6.1 | 2018-02-20 | A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSR… |
CVE-2018-7219 | High | 8.8 | 2018-02-19 | application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/adm… |
CVE-2017-16756 | High | 8.8 | 2018-02-19 | An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.ch… |
CVE-2018-7216 | High | 8.0 | 2018-02-18 | Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal allows remote authenticated users to hija… |
CVE-2018-7176 | High | 8.8 | 2018-02-16 | FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions pa… |
CVE-2017-5796 | High | 8.8 | 2018-02-15 | A Remote Cross Site Request Forgery (CSRF) vulnerability in HPE 2620 Series Network Switches version RA.15.05.0006 was found. |
CVE-2017-5781 | High | 8.8 | 2018-02-15 | A CSRF vulnerability in HPE Matrix Operating Environment version v7.6 was found. |
CVE-2016-8513 | High | 8.0 | 2018-02-15 | A Cross-Site Request Forgery (CSRF) vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6. |
CVE-2017-9963 | High | 8.1 | 2018-02-12 | A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCAD… |
CVE-2018-6888 | High | 8.0 | 2018-02-12 | An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forgery: using a forged… |
CVE-2018-1000053 | High | 8.8 | 2018-02-09 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation that can result in CSRF causing LimeSur… |
CVE-2017-17552 | High | 8.8 | 2018-02-07 | /LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a byp… |
CVE-2014-5280 | High | 8.8 | 2018-02-06 | boot2docker 1.2 and earlier allows attackers to conduct cross-site request forgery (CSRF) attacks by leveraging Docker daemons enabling TCP connections without… |
CVE-2018-6288 | High | 8.8 | 2018-02-06 | Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1. |
CVE-2018-6656 | Medium | 6.5 | 2018-02-06 | Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories. |
CVE-2018-6467 | High | 8.8 | 2018-02-06 | The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php. |
CVE-2018-6651 | High | 8.8 | 2018-02-05 | In the uncurl_ws_accept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin header validation (accepting an arbitra… |
CVE-2017-9414 | High | 8.8 | 2018-02-05 | Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of u… |