CWE-352 · Cross-Site Request Forgery (CSRF) (page 84)
Page 84 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-2142 | High | 8.0 | 2017-10-06 | Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to (1) hijack the authen… |
CVE-2017-15084 | Medium | 6.5 | 2017-10-06 | The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22. |
CVE-2017-15063 | High | 8.8 | 2017-10-06 | There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF… |
CVE-2017-1000093 | High | 8.8 | 2017-10-05 | Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to… |
CVE-2017-1000092 | High | 7.5 | 2017-10-05 | Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username… |
CVE-2017-1000091 | Medium | 6.3 | 2017-10-05 | GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan… |
CVE-2017-1000090 | High | 8.8 | 2017-10-05 | Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks… |
CVE-2017-1000085 | Medium | 6.5 | 2017-10-05 | Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperl… |
CVE-2016-6806 | High | 8.8 | 2017-10-03 | Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitiga… |
CVE-2017-14925 | High | 8.0 | 2017-09-30 | Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allo… |
CVE-2017-14924 | High | 8.0 | 2017-09-30 | Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allo… |
CVE-2015-9233 | High | 8.8 | 2017-09-30 | The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.ph… |
CVE-2017-13129 | High | 8.0 | 2017-09-26 | Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrato… |
CVE-2017-7969 | High | 8.8 | 2017-09-26 | A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCAD… |
CVE-2015-7293 | High | 8.8 | 2017-09-25 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x. |
CVE-2015-5182 | High | 8.8 | 2017-09-25 | Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ. |
CVE-2017-14683 | High | 8.8 | 2017-09-25 | geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload. |
CVE-2015-0276 | High | 8.8 | 2017-09-21 | Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2. |
CVE-2017-12253 | High | 8.8 | 2017-09-21 | A vulnerability in the Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due… |
CVE-2015-5395 | High | 8.8 | 2017-09-20 | Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0. |
CVE-2015-5607 | High | 8.8 | 2017-09-20 | Cross-site request forgery in the REST API in IPython 2 and 3. |
CVE-2015-4089 | High | 8.8 | 2017-09-19 | Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPr… |
CVE-2014-6106 | High | 8.8 | 2017-09-18 | Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of user… |
CVE-2017-14530 | High | 8.0 | 2017-09-18 | WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstr… |
CVE-2016-8737 | High | 8.8 | 2017-09-13 | In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link… |
CVE-2017-11350 | High | 8.8 | 2017-09-13 | Cross-Site Request Forgery (CSRF) exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices. |
CVE-2017-14267 | High | 8.8 | 2017-09-11 | EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, gofor… |
CVE-2015-4697 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563. |
CVE-2015-4619 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75. |
CVE-2014-9565 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware 3.4.0000 and earlier. |
CVE-2017-12838 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests that (1) send manas… |
CVE-2017-11567 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests th… |
CVE-2017-1097 | High | 8.8 | 2017-09-05 | IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site request forgery which could allow an attacker to execut… |
CVE-2017-14048 | High | 8.8 | 2017-08-31 | BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_cre… |
CVE-2017-1442 | High | 8.8 | 2017-08-30 | IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized acti… |
CVE-2016-2965 | Medium | 6.5 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a us… |
CVE-2016-0356 | Medium | 6.5 | 2017-08-29 | IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sh… |
CVE-2016-0355 | Medium | 6.5 | 2017-08-29 | IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sh… |
CVE-2017-11455 | High | 8.8 | 2017-08-29 | diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through… |
CVE-2015-3655 | High | 8.8 | 2017-08-29 | Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijac… |
CVE-2014-8900 | High | 8.8 | 2017-08-28 | Cross-site request forgery (CSRF) vulnerability in IBM UrbanCode Release 6.0.1.6 and earlier, 6.1.0.7 and earlier, and 6.1.1.1 and earlier. |
CVE-2017-7926 | High | 8.8 | 2017-08-25 | A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 (1.9.0). The vulnerability allows cross-site request forgery (CS… |
CVE-2017-12703 | High | 8.8 | 2017-08-25 | A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than… |
CVE-2017-12970 | High | 8.8 | 2017-08-23 | Cross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of authenticated users for requests… |
CVE-2015-5258 | High | 8.8 | 2017-08-22 | Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3. |
CVE-2017-7557 | High | 8.8 | 2017-08-22 | dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. |
CVE-2017-7423 | High | 8.8 | 2017-08-21 | A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8… |
CVE-2017-5187 | High | 8.8 | 2017-08-21 | A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and… |
CVE-2017-12881 | High | 8.8 | 2017-08-18 | Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified vict… |
CVE-2015-5081 | High | 8.8 | 2017-08-18 | Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into per… |
CVE-2017-12593 | High | 8.8 | 2017-08-18 | ASUS DSL-N10S V2.1.16_APAC devices allow CSRF. |
CVE-2017-12589 | High | 8.8 | 2017-08-18 | ToMAX R60G R60GV2-V2.0-v.2.6.3-170330 devices do not have any protection against a CSRF attack. |
CVE-2017-7556 | High | 8.8 | 2017-08-17 | Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a… |
CVE-2017-12853 | High | 8.8 | 2017-08-14 | The RealTime RWR-3G-100 Router Firmware Version : Ver1.0.56 is affected by CSRF an attack that forces an end user to execute unwanted actions on a web applicat… |
CVE-2017-6328 | High | 8.8 | 2017-08-11 | The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSR… |
CVE-2017-12651 | High | 8.8 | 2017-08-07 | Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HT… |
CVE-2017-6756 | High | 8.8 | 2017-08-07 | A vulnerability in the Web UI Application of the Cisco Prime Collaboration Provisioning Tool through 12.2 could allow an unauthenticated, remote attacker to ex… |
CVE-2017-10677 | High | 8.8 | 2017-08-06 | Cross-Site Request Forgery (CSRF) exists on Linksys EA4500 devices with Firmware Version before 2.1.41.164606, as demonstrated by a request to apply.cgi to dis… |
CVE-2017-12584 | High | 8.8 | 2017-08-06 | There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile (including the password) can be updated without sending the current p… |
CVE-2017-9863 | High | 8.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. If a user simultaneously has Sunny Explorer running and visits a malicious host, cross-site request f… |
CVE-2017-12439 | High | 7.5 | 2017-08-05 | SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xml_path HTTP parameter that trusts user-supplied in… |
CVE-2017-2138 | High | 8.8 | 2017-08-02 | Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4… |
CVE-2017-11726 | High | 8.8 | 2017-07-31 | services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstrated by changing an… |
CVE-2017-11648 | High | 8.8 | 2017-07-31 | Techroutes TR 1803-3G Wireless Cellular Router/Modem 2.4.25 devices do not possess any protection against a CSRF vulnerability, as demonstrated by a goform/Bas… |
CVE-2016-9716 | High | 8.8 | 2017-07-31 | IBM InfoSphere Master Data Management Server 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site request forgery which could allow an attacker to exec… |
CVE-2016-9714 | High | 8.8 | 2017-07-31 | IBM InfoSphere Master Data Management Server 10.1, 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site request forgery which could allow an attacker t… |
CVE-2017-9490 | High | 8.8 | 2017-07-31 | The Comcast firmware on Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows configuration changes… |
CVE-2017-9489 | High | 8.8 | 2017-07-31 | The Comcast firmware on Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST) devices allows configuration changes via CSRF. |
CVE-2017-11646 | High | 8.8 | 2017-07-28 | NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to CSRF attacks, as demonstrated by using administ… |
CVE-2017-11680 | High | 8.8 | 2017-07-27 | Cross-Site Request Forgery (CSRF) exists in Hashtopussy 0.4.0, allowing an admin password change via users.php. |
CVE-2017-11679 | High | 8.8 | 2017-07-27 | Cross-Site Request Forgery (CSRF) exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action. |
CVE-2017-9413 | High | 8.8 | 2017-07-25 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of user… |
CVE-2017-2273 | High | 8.8 | 2017-07-22 | Cross-site request forgery (CSRF) vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to hij… |
CVE-2017-9415 | High | 7.5 | 2017-07-21 | Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of… |
CVE-2015-4639 | High | 8.8 | 2017-07-21 | Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows rem… |
CVE-2017-9930 | High | 8.8 | 2017-07-21 | Cross-Site Request Forgery (CSRF) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by a request to ajax.cgi that enables… |
CVE-2017-1218 | High | 8.8 | 2017-07-19 | IBM Tivoli Endpoint Manager is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2016-7507 | High | 8.0 | 2017-07-19 | Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an… |
CVE-2017-10961 | High | 8.8 | 2017-07-18 | REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload components. |
CVE-2017-9810 | High | 8.8 | 2017-07-17 | There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version… |
CVE-2017-7666 | High | 8.8 | 2017-07-17 | Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks. |
CVE-2017-1000069 | High | 8.8 | 2017-07-17 | CSRF in Bitly oauth2_proxy 2.1 during authentication flow |
CVE-2017-1000008 | High | 8.8 | 2017-07-17 | Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify a… |
CVE-2017-11196 | High | 8.8 | 2017-07-12 | Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to log… |
CVE-2017-11193 | High | 8.8 | 2017-07-12 | Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, tracerout… |
CVE-2017-2244 | High | 8.8 | 2017-07-07 | Cross-site request forgery (CSRF) vulnerability in MFC-J960DWN firmware ver.D and earlier allows remote attackers to hijack the authentication of administrator… |
CVE-2017-2238 | High | 8.8 | 2017-07-07 | Cross-site request forgery (CSRF) vulnerability in Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier and Toshiba Home gateway HEM-GW26A f… |
CVE-2017-2223 | High | 8.8 | 2017-07-07 | Cross-site request forgery (CSRF) vulnerability in TS-WPTCAM, TS-PTCAM, TS-PTCAM/POE, TS-WLC2, TS-WLCE, TS-WRLC firmware version 1.19 and earlier and TS-WPTCAM… |
CVE-2017-7404 | High | 8.8 | 2017-07-07 | On the D-Link DIR-615 before v20.12PTb04, if a victim logged in to the Router's Web Interface visits a malicious site from another Browser tab, the malicious s… |
CVE-2017-4998 | High | 8.8 | 2017-07-07 | EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is potentially affected by a cross-site request forgery vulnerability. A remote low privile… |
CVE-2017-5943 | High | 8.8 | 2017-07-03 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site re… |
CVE-2017-6042 | High | 8.8 | 2017-06-30 | A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior t… |
CVE-2017-6038 | High | 7.1 | 2017-06-30 | A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does n… |
CVE-2017-10681 | High | 8.8 | 2017-06-29 | Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock al… |
CVE-2017-10680 | High | 8.8 | 2017-06-29 | Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a… |
CVE-2017-10678 | High | 8.8 | 2017-06-29 | Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete pe… |
CVE-2017-5528 | High | 8.8 | 2017-06-29 | Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request… |
CVE-2017-6086 | High | 8.8 | 2017-06-27 | Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the… |
CVE-2016-1000218 | High | 8.8 | 2017-06-16 | Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports whenever an authentica… |
CVE-2017-9673 | High | 8.8 | 2017-06-15 | In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account (via the index.php/user/new URI) or change its settings (via the index… |