CWE-352 · Cross-Site Request Forgery (CSRF) (page 83)
Page 83 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2244 | High | 8.8 | 2017-07-07 | Cross-site request forgery (CSRF) vulnerability in MFC-J960DWN firmware ver.D and earlier allows remote attackers to hijack the authentication of administrator… |
CVE-2017-2238 | High | 8.8 | 2017-07-07 | Cross-site request forgery (CSRF) vulnerability in Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier and Toshiba Home gateway HEM-GW26A f… |
CVE-2017-2223 | High | 8.8 | 2017-07-07 | Cross-site request forgery (CSRF) vulnerability in TS-WPTCAM, TS-PTCAM, TS-PTCAM/POE, TS-WLC2, TS-WLCE, TS-WRLC firmware version 1.19 and earlier and TS-WPTCAM… |
CVE-2017-7404 | High | 8.8 | 2017-07-07 | On the D-Link DIR-615 before v20.12PTb04, if a victim logged in to the Router's Web Interface visits a malicious site from another Browser tab, the malicious s… |
CVE-2017-4998 | High | 8.8 | 2017-07-07 | EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is potentially affected by a cross-site request forgery vulnerability. A remote low privile… |
CVE-2017-5943 | High | 8.8 | 2017-07-03 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site re… |
CVE-2017-6042 | High | 8.8 | 2017-06-30 | A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior t… |
CVE-2017-6038 | High | 7.1 | 2017-06-30 | A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does n… |
CVE-2017-10681 | High | 8.8 | 2017-06-29 | Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock al… |
CVE-2017-10680 | High | 8.8 | 2017-06-29 | Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a… |
CVE-2017-10678 | High | 8.8 | 2017-06-29 | Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete pe… |
CVE-2017-5528 | High | 8.8 | 2017-06-29 | Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request… |
CVE-2017-6086 | High | 8.8 | 2017-06-27 | Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the… |
CVE-2016-1000218 | High | 8.8 | 2017-06-16 | Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports whenever an authentica… |
CVE-2017-9673 | High | 8.8 | 2017-06-15 | In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account (via the index.php/user/new URI) or change its settings (via the index… |
CVE-2017-5244 | Low | 3.5 | 2017-06-15 | Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the st… |
CVE-2017-6659 | High | 8.8 | 2017-06-13 | A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross… |
CVE-2016-7822 | High | 8.8 | 2017-06-09 | Cross-site request forgery (CSRF) vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows remote attackers to hijack the auth… |
CVE-2016-7809 | High | 8.8 | 2017-06-09 | Cross-site request forgery (CSRF) vulnerability in Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows remote attackers to hijack the authentication of lo… |
CVE-2016-4909 | Medium | 4.3 | 2017-06-09 | Cross-site request forgery (CSRF) vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to hijack the authentication of a logged in user to for… |
CVE-2016-4907 | High | 8.8 | 2017-06-09 | Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors. |
CVE-2016-9991 | High | 8.0 | 2017-06-08 | IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized a… |
CVE-2015-1786 | High | 8.8 | 2017-06-08 | Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers. |
CVE-2017-9519 | High | 8.8 | 2017-06-08 | atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account. |
CVE-2017-9518 | High | 8.8 | 2017-06-08 | atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails. |
CVE-2017-9517 | High | 8.8 | 2017-06-08 | atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV. |
CVE-2017-9444 | High | 8.8 | 2017-06-05 | BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/… |
CVE-2017-8836 | High | 8.8 | 2017-06-05 | CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. Th… |
CVE-2016-8229 | High | 8.8 | 2017-06-04 | A cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker with access to the DHCP server used by t… |
CVE-2017-9379 | High | 8.8 | 2017-06-02 | Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or… |
CVE-2017-9365 | High | 8.8 | 2017-06-02 | CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false. A page w… |
CVE-2017-7917 | High | 8.8 | 2017-05-29 | A Cross-Site Request Forgery issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Bu… |
CVE-2017-9033 | High | 8.8 | 2017-05-26 | Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication… |
CVE-2015-3191 | High | 8.8 | 2017-05-25 | With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the… |
CVE-2017-5657 | High | 8.0 | 2017-05-22 | Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same brows… |
CVE-2016-4904 | High | 8.8 | 2017-05-22 | Cross-site request forgery (CSRF) vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to… |
CVE-2016-4854 | High | 8.8 | 2017-05-22 | Cross-site request forgery (CSRF) vulnerability in L-04D firmware version V10a and V10b allows remote attackers to hijack the authentication of administrators… |
CVE-2017-6634 | High | 8.8 | 2017-05-22 | A vulnerability in the Device Manager web interface of Cisco Industrial Ethernet 1000 Series Switches 1.3 could allow an unauthenticated, remote attacker to co… |
CVE-2017-7620 | Medium | 6.5 | 2017-05-21 | MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of… |
CVE-2017-9064 | High | 8.8 | 2017-05-18 | In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for up… |
CVE-2017-9062 | High | 8.6 | 2017-05-18 | In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. |
CVE-2016-3403 | High | 8.8 | 2017-05-17 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack t… |
CVE-2017-7662 | High | 8.8 | 2017-05-16 | Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to… |
CVE-2017-7661 | High | 8.8 | 2017-05-16 | Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnera… |
CVE-2017-8382 | Medium | 4.5 | 2017-05-16 | admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts. |
CVE-2017-7491 | Medium | 4.3 | 2017-05-15 | In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration s… |
CVE-2017-8930 | High | 8.8 | 2017-05-14 | Multiple cross-site request forgery (CSRF) vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for r… |
CVE-2017-8928 | High | 8.8 | 2017-05-14 | mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF. |
CVE-2016-4887 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Uploader version 3.0.10 and earlier allows remote attackers to hijack the authentication of… |
CVE-2016-4886 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of admi… |
CVE-2016-4885 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Feed version 3.0.10 and earlier allows remote attackers to hijack the authentication of admi… |
CVE-2016-4884 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of admi… |
CVE-2016-4882 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators v… |
CVE-2016-4881 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of admi… |
CVE-2016-4879 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of admi… |
CVE-2016-4878 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators v… |
CVE-2016-4876 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators t… |
CVE-2016-9092 | High | 8.8 | 2017-05-11 | The Symantec Content Analysis (CA) 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense (MTD) 1.1 management consoles are susceptible to a cross-site request for… |
CVE-2016-5889 | High | 8.8 | 2017-05-10 | IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tr… |
CVE-2017-8875 | Medium | 6.5 | 2017-05-10 | CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL. |
CVE-2017-8874 | High | 8.8 | 2017-05-10 | Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) d… |
CVE-2017-5891 | High | 8.8 | 2017-05-10 | ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF. |
CVE-2017-8848 | Medium | 6.5 | 2017-05-08 | Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password. |
CVE-2017-7431 | High | 8.8 | 2017-05-03 | Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have persistent CSRF in object management. |
CVE-2017-1194 | High | 8.8 | 2017-04-28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unau… |
CVE-2017-2102 | High | 8.8 | 2017-04-28 | Cross-site request forgery (CSRF) vulnerability in Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attacker… |
CVE-2017-2097 | High | 8.8 | 2017-04-28 | Cross-site request forgery (CSRF) vulnerability in Knowledge versions prior to v1.7.0 allows remote attackers to hijack the authentication of administrators vi… |
CVE-2017-8101 | High | 8.8 | 2017-04-24 | There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request. |
CVE-2017-8100 | Medium | 6.5 | 2017-04-24 | There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings. |
CVE-2017-8099 | High | 8.1 | 2017-04-24 | There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request. |
CVE-2017-8098 | Medium | 6.5 | 2017-04-24 | e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can use forged requests… |
CVE-2016-3691 | High | 8.8 | 2017-04-24 | Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method. |
CVE-2017-7852 | High | 8.8 | 2017-04-24 | D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings vi… |
CVE-2017-8082 | Medium | 6.5 | 2017-04-24 | concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely tricking an admin… |
CVE-2016-0720 | High | 8.8 | 2017-04-21 | Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149. |
CVE-2017-7951 | High | 8.8 | 2017-04-21 | WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context. |
CVE-2017-7990 | High | 8.8 | 2017-04-21 | The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a… |
CVE-2016-5401 | High | 8.8 | 2017-04-20 | Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests tha… |
CVE-2016-3734 | High | 8.8 | 2017-04-20 | Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and ear… |
CVE-2016-1161 | High | 8.0 | 2017-04-20 | Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before 8.5 (Build 8500). |
CVE-2017-5156 | High | 8.8 | 2017-04-20 | A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The client request may be… |
CVE-2017-7881 | High | 8.8 | 2017-04-15 | BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/de… |
CVE-2017-7877 | High | 8.8 | 2017-04-14 | CSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations. |
CVE-2016-4891 | High | 8.8 | 2017-04-12 | Cross-site request forgery (CSRF) vulnerability in SetsucoCMS all versions allows remote attackers to hijack the authentication of an administrator to change s… |
CVE-2015-7563 | High | 8.8 | 2017-04-12 | Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an authenticated user. |
CVE-2016-8718 | High | 8.8 | 2017-04-12 | An exploitable Cross-Site Request Forgery vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1… |
CVE-2016-4319 | High | 8.8 | 2017-04-10 | Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings. |
CVE-2015-8255 | High | 8.8 | 2017-04-10 | AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi. |
CVE-2017-7571 | High | 8.0 | 2017-04-06 | public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges. |
CVE-2017-7447 | High | 8.8 | 2017-04-05 | HelpDEZk 1.1.1 has CSRF in admin/home#/logos/ with an impact of remote execution of arbitrary PHP code. |
CVE-2017-7446 | High | 8.8 | 2017-04-05 | HelpDEZk 1.1.1 has CSRF in admin/home#/person/ with an impact of obtaining admin privileges. |
CVE-2016-6100 | High | 8.8 | 2017-04-05 | IBM Disposal and Governance Management for IT and IBM Global Retention Policy and Schedule Management, components of IBM Atlas Policy Suite 6.0.3 is vulnerable… |
CVE-2017-7398 | High | 8.8 | 2017-04-04 | D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability. This enables an attacker to perform an unwanted action on a wi… |
CVE-2016-10313 | High | 8.8 | 2017-04-03 | Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4)… |
CVE-2014-9694 | High | 8.8 | 2017-04-02 | Huawei Tecal RH1288 V2 V100R002C00SPC107 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285 V2 V100R002C00SPC115 and earlier versions, Tecal RH226… |
CVE-2014-9137 | High | 8.8 | 2017-04-02 | Huawei USG9500 with software V200R001C01SPC800 and earlier versions, V300R001C00; USG2100 with software V300R001C00SPC900 and earlier versions; USG2200 with so… |
CVE-2014-9136 | High | 8.8 | 2017-04-02 | Huawei FusionManager with software V100R002C03 and V100R003C00 could allow an unauthenticated, remote attacker to conduct a CSRF attack against the user of the… |
CVE-2016-8917 | High | 8.8 | 2017-03-31 | IBM Sterling Order Management 9.2 - 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2017-2688 | High | 8.8 | 2017-03-29 | The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow remote attackers to perform actions with the privileges of an… |
CVE-2016-9456 | High | 8.8 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts… |