CWE-352 · Cross-Site Request Forgery (CSRF) (page 82)
Page 82 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-15732 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php. |
CVE-2017-15731 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php. |
CVE-2017-15730 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. |
CVE-2017-15729 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary. |
CVE-2017-15645 | High | 8.8 | 2017-10-19 | CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands. |
CVE-2017-12271 | High | 8.8 | 2017-10-19 | A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device… |
CVE-2017-14956 | Medium | 5.7 | 2017-10-18 | AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/ossim/report/wizard_email.php" script… |
CVE-2015-7715 | High | 8.8 | 2017-10-18 | Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows remote attackers to hijack the authenti… |
CVE-2014-3709 | High | 8.8 | 2017-10-18 | The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request f… |
CVE-2017-14011 | High | 8.8 | 2017-10-17 | A Cross-Site Request Forgery issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The application does not sufficiently verify requests… |
CVE-2017-15296 | High | 8.8 | 2017-10-16 | The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964. |
CVE-2016-1265 | Critical | 9.8 | 2017-10-13 | A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos… |
CVE-2016-1261 | High | 7.1 | 2017-10-13 | J-Web does not validate certain input that may lead to cross-site request forgery (CSRF) issues or cause a denial of J-Web service (DoS). |
CVE-2016-5789 | High | 8.0 | 2017-10-13 | A Cross-site Request Forgery issue was discovered in JanTek JTC-200, all versions. An attacker could perform actions with the same permissions as a victim user… |
CVE-2015-2143 | High | 8.8 | 2017-10-06 | Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to hijack the authentication of us… |
CVE-2015-2142 | High | 8.0 | 2017-10-06 | Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to (1) hijack the authen… |
CVE-2017-15084 | Medium | 6.5 | 2017-10-06 | The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22. |
CVE-2017-15063 | High | 8.8 | 2017-10-06 | There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF… |
CVE-2017-1000093 | High | 8.8 | 2017-10-05 | Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to… |
CVE-2017-1000092 | High | 7.5 | 2017-10-05 | Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username… |
CVE-2017-1000091 | Medium | 6.3 | 2017-10-05 | GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan… |
CVE-2017-1000090 | High | 8.8 | 2017-10-05 | Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks… |
CVE-2017-1000085 | Medium | 6.5 | 2017-10-05 | Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperl… |
CVE-2016-6806 | High | 8.8 | 2017-10-03 | Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitiga… |
CVE-2017-14925 | High | 8.0 | 2017-09-30 | Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allo… |
CVE-2017-14924 | High | 8.0 | 2017-09-30 | Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allo… |
CVE-2015-9233 | High | 8.8 | 2017-09-30 | The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.ph… |
CVE-2017-13129 | High | 8.0 | 2017-09-26 | Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrato… |
CVE-2017-7969 | High | 8.8 | 2017-09-26 | A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCAD… |
CVE-2015-7293 | High | 8.8 | 2017-09-25 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x. |
CVE-2015-5182 | High | 8.8 | 2017-09-25 | Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ. |
CVE-2017-14683 | High | 8.8 | 2017-09-25 | geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload. |
CVE-2015-0276 | High | 8.8 | 2017-09-21 | Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2. |
CVE-2017-12253 | High | 8.8 | 2017-09-21 | A vulnerability in the Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due… |
CVE-2015-5395 | High | 8.8 | 2017-09-20 | Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0. |
CVE-2015-5607 | High | 8.8 | 2017-09-20 | Cross-site request forgery in the REST API in IPython 2 and 3. |
CVE-2015-4089 | High | 8.8 | 2017-09-19 | Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPr… |
CVE-2014-6106 | High | 8.8 | 2017-09-18 | Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of user… |
CVE-2017-14530 | High | 8.0 | 2017-09-18 | WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstr… |
CVE-2016-8737 | High | 8.8 | 2017-09-13 | In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link… |
CVE-2017-11350 | High | 8.8 | 2017-09-13 | Cross-Site Request Forgery (CSRF) exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices. |
CVE-2017-14267 | High | 8.8 | 2017-09-11 | EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, gofor… |
CVE-2015-4697 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563. |
CVE-2015-4619 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75. |
CVE-2014-9565 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware 3.4.0000 and earlier. |
CVE-2017-12838 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests that (1) send manas… |
CVE-2017-11567 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests th… |
CVE-2017-1097 | High | 8.8 | 2017-09-05 | IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site request forgery which could allow an attacker to execut… |
CVE-2017-14048 | High | 8.8 | 2017-08-31 | BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_cre… |
CVE-2017-1442 | High | 8.8 | 2017-08-30 | IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized acti… |
CVE-2016-2965 | Medium | 6.5 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a us… |
CVE-2016-0356 | Medium | 6.5 | 2017-08-29 | IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sh… |
CVE-2016-0355 | Medium | 6.5 | 2017-08-29 | IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sh… |
CVE-2017-11455 | High | 8.8 | 2017-08-29 | diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through… |
CVE-2015-3655 | High | 8.8 | 2017-08-29 | Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijac… |
CVE-2014-8900 | High | 8.8 | 2017-08-28 | Cross-site request forgery (CSRF) vulnerability in IBM UrbanCode Release 6.0.1.6 and earlier, 6.1.0.7 and earlier, and 6.1.1.1 and earlier. |
CVE-2017-7926 | High | 8.8 | 2017-08-25 | A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 (1.9.0). The vulnerability allows cross-site request forgery (CS… |
CVE-2017-12703 | High | 8.8 | 2017-08-25 | A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than… |
CVE-2017-12970 | High | 8.8 | 2017-08-23 | Cross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of authenticated users for requests… |
CVE-2015-5258 | High | 8.8 | 2017-08-22 | Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3. |
CVE-2017-7557 | High | 8.8 | 2017-08-22 | dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. |
CVE-2017-7423 | High | 8.8 | 2017-08-21 | A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8… |
CVE-2017-5187 | High | 8.8 | 2017-08-21 | A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and… |
CVE-2017-12881 | High | 8.8 | 2017-08-18 | Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified vict… |
CVE-2015-5081 | High | 8.8 | 2017-08-18 | Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into per… |
CVE-2017-12593 | High | 8.8 | 2017-08-18 | ASUS DSL-N10S V2.1.16_APAC devices allow CSRF. |
CVE-2017-12589 | High | 8.8 | 2017-08-18 | ToMAX R60G R60GV2-V2.0-v.2.6.3-170330 devices do not have any protection against a CSRF attack. |
CVE-2017-7556 | High | 8.8 | 2017-08-17 | Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a… |
CVE-2017-12853 | High | 8.8 | 2017-08-14 | The RealTime RWR-3G-100 Router Firmware Version : Ver1.0.56 is affected by CSRF an attack that forces an end user to execute unwanted actions on a web applicat… |
CVE-2017-6328 | High | 8.8 | 2017-08-11 | The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSR… |
CVE-2017-12651 | High | 8.8 | 2017-08-07 | Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HT… |
CVE-2017-6756 | High | 8.8 | 2017-08-07 | A vulnerability in the Web UI Application of the Cisco Prime Collaboration Provisioning Tool through 12.2 could allow an unauthenticated, remote attacker to ex… |
CVE-2017-10677 | High | 8.8 | 2017-08-06 | Cross-Site Request Forgery (CSRF) exists on Linksys EA4500 devices with Firmware Version before 2.1.41.164606, as demonstrated by a request to apply.cgi to dis… |
CVE-2017-12584 | High | 8.8 | 2017-08-06 | There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile (including the password) can be updated without sending the current p… |
CVE-2017-9863 | High | 8.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. If a user simultaneously has Sunny Explorer running and visits a malicious host, cross-site request f… |
CVE-2017-12439 | High | 7.5 | 2017-08-05 | SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xml_path HTTP parameter that trusts user-supplied in… |
CVE-2017-2138 | High | 8.8 | 2017-08-02 | Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4… |
CVE-2017-11726 | High | 8.8 | 2017-07-31 | services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstrated by changing an… |
CVE-2017-11648 | High | 8.8 | 2017-07-31 | Techroutes TR 1803-3G Wireless Cellular Router/Modem 2.4.25 devices do not possess any protection against a CSRF vulnerability, as demonstrated by a goform/Bas… |
CVE-2016-9716 | High | 8.8 | 2017-07-31 | IBM InfoSphere Master Data Management Server 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site request forgery which could allow an attacker to exec… |
CVE-2016-9714 | High | 8.8 | 2017-07-31 | IBM InfoSphere Master Data Management Server 10.1, 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site request forgery which could allow an attacker t… |
CVE-2017-9490 | High | 8.8 | 2017-07-31 | The Comcast firmware on Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows configuration changes… |
CVE-2017-9489 | High | 8.8 | 2017-07-31 | The Comcast firmware on Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST) devices allows configuration changes via CSRF. |
CVE-2017-11646 | High | 8.8 | 2017-07-28 | NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to CSRF attacks, as demonstrated by using administ… |
CVE-2017-11680 | High | 8.8 | 2017-07-27 | Cross-Site Request Forgery (CSRF) exists in Hashtopussy 0.4.0, allowing an admin password change via users.php. |
CVE-2017-11679 | High | 8.8 | 2017-07-27 | Cross-Site Request Forgery (CSRF) exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action. |
CVE-2017-9413 | High | 8.8 | 2017-07-25 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of user… |
CVE-2017-2273 | High | 8.8 | 2017-07-22 | Cross-site request forgery (CSRF) vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to hij… |
CVE-2017-9415 | High | 7.5 | 2017-07-21 | Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of… |
CVE-2015-4639 | High | 8.8 | 2017-07-21 | Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows rem… |
CVE-2017-9930 | High | 8.8 | 2017-07-21 | Cross-Site Request Forgery (CSRF) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by a request to ajax.cgi that enables… |
CVE-2017-1218 | High | 8.8 | 2017-07-19 | IBM Tivoli Endpoint Manager is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2016-7507 | High | 8.0 | 2017-07-19 | Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an… |
CVE-2017-10961 | High | 8.8 | 2017-07-18 | REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload components. |
CVE-2017-9810 | High | 8.8 | 2017-07-17 | There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version… |
CVE-2017-7666 | High | 8.8 | 2017-07-17 | Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks. |
CVE-2017-1000069 | High | 8.8 | 2017-07-17 | CSRF in Bitly oauth2_proxy 2.1 during authentication flow |
CVE-2017-1000008 | High | 8.8 | 2017-07-17 | Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify a… |
CVE-2017-11196 | High | 8.8 | 2017-07-12 | Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to log… |
CVE-2017-11193 | High | 8.8 | 2017-07-12 | Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, tracerout… |