CWE-352 · Cross-Site Request Forgery (CSRF) (page 84)
Page 84 of 96 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9455 | High | 8.8 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). A number of scripts in Revive Adserver's user interface are vulnerable to CSRF att… |
CVE-2016-9127 | High | 8.8 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This… |
CVE-2017-6069 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter. |
CVE-2017-6068 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter. |
CVE-2017-6066 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action, and can optionally insert XSS via the title parameter. |
CVE-2017-6002 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. The attacker can add any blog entry, and can optionally insert XSS into that entry via the body parameter. |
CVE-2015-8624 | High | 8.8 | 2017-03-23 | The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does n… |
CVE-2015-8623 | High | 8.8 | 2017-03-23 | The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time… |
CVE-2016-5758 | High | 8.8 | 2017-03-23 | A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated upl… |
CVE-2017-5874 | High | 8.8 | 2017-03-22 | CSRF exists on D-Link DIR-600M Rev. Cx devices before v3.05ENB01_beta_20170306. This can be used to bypass authentication and insert XSS sequences or possibly… |
CVE-2016-4504 | High | 8.8 | 2017-03-21 | A Cross-Site Request Forgery issue was discovered in Meteocontrol WEB'log Basic 100 all versions, Light all versions, Pro all versions, and Pro Unlimited all v… |
CVE-2016-4928 | High | 8.8 | 2017-03-20 | Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on Junos Space. |
CVE-2017-6803 | High | 8.8 | 2017-03-20 | Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly Serv-U) FTP Voyager 16.2.0 allow remot… |
CVE-2017-7178 | High | 8.8 | 2017-03-18 | CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary progra… |
CVE-2017-3877 | Medium | 6.5 | 2017-03-17 | A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2017-0045 | Medium | 5.5 | 2017-03-17 | Windows DVD Maker in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Vista SP2 does not properly parse crafted .msdvd files, which allows attack… |
CVE-2017-6379 | High | 7.5 | 2017-03-16 | Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This… |
CVE-2017-6918 | Medium | 4.3 | 2017-03-15 | CSRF exists in BigTree CMS 4.2.16 with the value[#][*] parameter to the admin/settings/update/ page. The Navigation Social can be changed. |
CVE-2017-6917 | Medium | 4.3 | 2017-03-15 | CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Colophon can be changed. |
CVE-2017-6916 | Medium | 4.3 | 2017-03-15 | CSRF exists in BigTree CMS 4.1.18 with the nav-social[#] parameter to the admin/settings/update/ page. The Navigation Social can be changed. |
CVE-2017-6915 | Medium | 4.3 | 2017-03-15 | CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the admin/settings/update/ page. The Colophon can be changed. |
CVE-2017-6914 | High | 7.1 | 2017-03-15 | CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. A user can be deleted. |
CVE-2017-6366 | High | 8.8 | 2017-03-15 | Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the auth… |
CVE-2016-8018 | Medium | 4.3 | 2017-03-14 | Cross-site request forgery (CSRF) vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers t… |
CVE-2017-6180 | High | 8.8 | 2017-03-13 | Keekoon KK002 devices 1.8.12 HD have a Cross Site Request Forgery Vulnerability affecting goform/formChnUserPwd and goform/formUserMng (and the entire set of o… |
CVE-2017-6081 | High | 8.8 | 2017-03-13 | A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. To exploit the vulnerability, an attacker can send cross-domain… |
CVE-2017-6080 | Critical | 9.8 | 2017-03-13 | An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Cont… |
CVE-2017-6819 | Medium | 6.5 | 2017-03-12 | In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of se… |
CVE-2016-9730 | Medium | 4.3 | 2017-03-07 | IBM QRadar Incident Forensics 7.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions trans… |
CVE-2017-6411 | High | 8.8 | 2017-03-06 | Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_1.00 devices allows remote attackers to change the DNS or firewall configuration or any password. |
CVE-2017-5633 | High | 8.0 | 2017-03-06 | Multiple cross-site request forgery (CSRF) vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to (1) change the adm… |
CVE-2015-8814 | High | 8.8 | 2017-03-03 | Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by… |
CVE-2016-10206 | High | 8.8 | 2017-03-03 | Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that… |
CVE-2017-2682 | High | 8.8 | 2017-02-27 | The Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could allow a remote attacker to perform a Cross-Site Request Forgery (CSRF) att… |
CVE-2016-9975 | High | 8.8 | 2017-02-24 | IBM Jazz for Service Management 1.1.2.1 and 1.1.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2017-6127 | High | 8.8 | 2017-02-21 | Multiple cross-site request forgery (CSRF) vulnerabilities in the access portal on the DIGISOL DG-HR1400 Wireless Router with firmware 1.00.02 allow remote att… |
CVE-2017-5959 | Critical | 9.8 | 2017-02-21 | CSRF token bypass in GeniXCMS before 1.0.2 could result in escalation of privileges. The forgotpassword.php page can be used to acquire a token. |
CVE-2016-4315 | Medium | 5.7 | 2017-02-17 | Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that… |
CVE-2016-4311 | High | 8.8 | 2017-02-17 | Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of… |
CVE-2016-6033 | High | 8.8 | 2017-02-15 | IBM Tivoli Storage Manager for Virtual Environments 7.1 (VMware) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious… |
CVE-2017-5169 | High | 7.5 | 2017-02-13 | An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Cross Site Request Forgery vulnerabilities have been identifi… |
CVE-2017-5165 | High | 7.6 | 2017-02-13 | An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. There is no CSRF Token generated per page and/or per (sensitive) func… |
CVE-2017-5145 | Critical | 10.0 | 2017-02-13 | An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of thi… |
CVE-2016-9365 | High | 8.8 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-8369 | High | 8.8 | 2017-02-13 | An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application does not sufficiently verify if a request was intentionally… |
CVE-2016-8350 | Medium | 6.3 | 2017-02-13 | An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version… |
CVE-2016-5809 | High | 8.8 | 2017-02-13 | An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and P… |
CVE-2016-5372 | Medium | 6.3 | 2017-02-07 | Cross-site request forgery (CSRF) vulnerability in NetApp Snap Creator Framework before 4.3.0P1 allows remote attackers to hijack the authentication of users f… |
CVE-2016-2539 | High | 8.8 | 2017-02-07 | Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for… |
CVE-2017-5368 | High | 8.8 | 2017-02-06 | ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site Request Forgery) which allows a remote attack to make… |
CVE-2016-6103 | High | 8.8 | 2017-02-02 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2016-8941 | High | 8.8 | 2017-02-01 | IBM Tivoli Storage Productivity Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2016-6045 | High | 8.8 | 2017-02-01 | IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2016-5937 | High | 8.8 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transm… |
CVE-2016-3029 | High | 8.8 | 2017-02-01 | IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tra… |
CVE-2017-3794 | High | 8.8 | 2017-01-26 | A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against an… |
CVE-2016-9218 | High | 8.8 | 2017-01-26 | A vulnerability in Cisco Hybrid Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against th… |
CVE-2016-6521 | High | 8.8 | 2017-01-23 | Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote at… |
CVE-2016-3406 | High | 8.8 | 2017-01-18 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecif… |
CVE-2016-6897 | Medium | 6.5 | 2017-01-18 | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remo… |
CVE-2016-7980 | High | 8.8 | 2017-01-18 | Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication o… |
CVE-2016-7904 | High | 8.0 | 2017-01-16 | Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requ… |
CVE-2017-5492 | High | 8.8 | 2017-01-15 | Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack th… |
CVE-2017-5489 | High | 8.8 | 2017-01-15 | Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vecto… |
CVE-2016-8201 | High | 8.0 | 2017-01-14 | A CSRF vulnerability in Brocade Virtual Traffic Manager versions released prior to and including 11.0 could allow an attacker to trick a logged-in user into ma… |
CVE-2017-5476 | High | 8.8 | 2017-01-14 | Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin. |
CVE-2017-5475 | High | 8.8 | 2017-01-14 | comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments. |
CVE-2017-5473 | High | 8.8 | 2017-01-14 | Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated… |
CVE-2016-4808 | High | 8.8 | 2017-01-11 | Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform… |
CVE-2015-4593 | High | 8.8 | 2017-01-10 | eClinicalWorks Population Health (CCMR) suffers from a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp which allows remote attackers t… |
CVE-2016-7454 | High | 8.0 | 2016-12-17 | CSRF vulnerability on Technicolor TC dpc3941T (formerly Cisco dpc3941T) devices with firmware dpc3941-P20-18-v303r20421733-160413a-CMCST allows an attacker to… |
CVE-2016-7885 | High | 8.8 | 2016-12-15 | Adobe Experience Manager versions 6.2 and earlier have a vulnerability that could be used in Cross-Site Request Forgery attacks. |
CVE-2016-6277 | High | 8.8 | 2016-12-14 | NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R730… |
CVE-2016-6468 | High | 8.8 | 2016-12-14 | A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site requ… |
CVE-2016-9866 | Critical | 9.8 | 2016-12-11 | An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return U… |
CVE-2016-2884 | High | 8.0 | 2016-11-30 | Cross-site request forgery (CSRF) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, al… |
CVE-2016-2878 | High | 8.0 | 2016-11-30 | Multiple cross-site request forgery (CSRF) vulnerabilities in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote attackers to hijack the… |
CVE-2016-3009 | Low | 3.5 | 2016-11-30 | Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hi… |
CVE-2016-3004 | Medium | 4.6 | 2016-11-30 | Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hi… |
CVE-2016-2963 | High | 8.8 | 2016-11-30 | Cross-site request forgery (CSRF) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authentication of arbitrary use… |
CVE-2016-8673 | High | 8.8 | 2016-11-23 | A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS N… |
CVE-2016-6454 | Medium | 6.5 | 2016-11-03 | A cross-site request forgery (CSRF) vulnerability in the web interface of the Cisco Hosted Collaboration Mediation Fulfillment application could allow an unaut… |
CVE-2016-6444 | High | 8.8 | 2016-10-27 | A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a Web Bri… |
CVE-2016-6442 | High | 8.8 | 2016-10-27 | A vulnerability in Cisco Finesse Agent and Supervisor Desktop Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery… |
CVE-2016-8504 | Medium | 4.3 | 2016-10-26 | CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile. |
CVE-2016-1000213 | High | 8.8 | 2016-10-25 | Ruckus Wireless H500 web management interface CSRF |
CVE-2016-6427 | High | 8.8 | 2016-10-06 | Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10… |
CVE-2016-6417 | High | 8.8 | 2016-10-05 | Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 4.10.2 through 6.1.0 and Firepower Management Center allows remote attackers… |
CVE-2016-6637 | Critical | 9.6 | 2016-09-30 | Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x bef… |
CVE-2016-3007 | High | 8.8 | 2016-09-26 | Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to… |
CVE-2016-4845 | High | 8.8 | 2016-09-24 | Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE HVL-A2.0, HVL-A3.0, HVL-A4.0, HVL-AT1.0S, HVL-AT2.0, HVL-AT3.0, HVL-AT4.0, HVL-AT2.0A, HVL-A… |
CVE-2016-6801 | High | 8.8 | 2016-09-21 | Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6… |
CVE-2016-6158 | Medium | 6.1 | 2016-09-21 | Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allow remote attackers to hi… |
CVE-2016-6642 | Medium | 6.1 | 2016-09-18 | Cross-site request forgery (CSRF) vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to hijack the authentication of administrators for request… |
CVE-2016-7034 | High | 8.8 | 2016-09-07 | The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, wh… |
CVE-2016-7123 | High | 8.8 | 2016-09-02 | Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote attackers to hijack the authentication of… |
CVE-2016-6893 | High | 8.8 | 2016-09-02 | Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authenticatio… |
CVE-2016-1470 | High | 8.8 | 2016-09-02 | Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows r… |
CVE-2016-2998 | Low | 3.5 | 2016-09-01 | Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authentic… |
CVE-2016-4069 | High | 8.8 | 2016-08-25 | Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests th… |