Search
Total
1927 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-16314 | 1 Icmsdev | 1 Icms | 2018-11-13 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRF_TOKEN, if CSRF_TOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header. | |||||
| CVE-2018-14769 | 1 Vivotek | 1 Camera | 2018-11-13 | 6.8 MEDIUM | 8.8 HIGH |
| VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF. | |||||
| CVE-2018-16345 | 1 Easycms | 1 Easycms | 2018-11-13 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent. | |||||
| CVE-2018-17366 | 1 Mcms Project | 1 Mcms | 2018-11-09 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do. | |||||
| CVE-2018-15121 | 1 Auth0 | 2 Aspnet, Aspnet-owin | 2018-11-08 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations. | |||||
| CVE-2017-15063 | 1 Intelliants | 1 Subrion | 2018-11-08 | 6.8 MEDIUM | 8.8 HIGH |
| There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing (for example) an attack against the query parameter to panel/database. | |||||
| CVE-2018-1000669 | 1 Koha | 1 Koha | 2018-11-07 | 6.8 MEDIUM | 8.8 HIGH |
| KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters affected: borrowernumber, amount, amountoutstanding, paid that can result in Attackers can mark payments as paid for certain users on behalf of Administrators. This attack appear to be exploitable via The victim must be socially engineered into clicking a link, usually via email. This vulnerability appears to have been fixed in 17.11. | |||||
| CVE-2018-17023 | 1 Asus | 2 Gt-ac5300, Gt-ac5300 Firmware | 2018-11-07 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm. | |||||
| CVE-2018-15682 | 1 Btiteam | 1 Xbtit | 2018-11-06 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to automate the action of sending private messages to users by luring an authenticated user to a web page that automatically submits a form on their behalf. | |||||
| CVE-2018-15901 | 1 E107 | 1 E107 | 2018-11-02 | 6.8 MEDIUM | 8.8 HIGH |
| e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators. | |||||
| CVE-2018-16431 | 1 Yfcmf | 1 Yfcmf | 2018-11-02 | 6.8 MEDIUM | 8.8 HIGH |
| admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account. | |||||
| CVE-2018-16951 | 1 Xunfeng Project | 1 Xunfeng | 2018-11-02 | 6.0 MEDIUM | 8.0 HIGH |
| xunfeng 0.2.0 allows command execution via CSRF because masscan.py mishandles backquote characters, a related issue to CVE-2018-16832. | |||||
| CVE-2018-16650 | 1 Phpmyfaq | 1 Phpmyfaq | 2018-11-02 | 6.8 MEDIUM | 8.8 HIGH |
| phpMyFAQ before 2.9.11 allows CSRF. | |||||
| CVE-2014-6046 | 1 Phpmyfaq | 1 Phpmyfaq | 2018-11-01 | 6.8 MEDIUM | 8.8 HIGH |
| Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) delete active users by leveraging improper validation of CSRF tokens or that (2) delete open questions, (3) activate users, (4) publish FAQs, (5) add or delete Glossary, (6) add or delete FAQ news, or (7) add or delete comments or add votes by leveraging lack of a CSRF token. | |||||
| CVE-2018-15568 | 1 Tp5cms Project | 1 Tp5cms | 2018-11-01 | 6.8 MEDIUM | 8.8 HIGH |
| tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html. | |||||
| CVE-2018-9092 | 1 1234n | 1 Minicms | 2018-10-30 | 6.8 MEDIUM | 8.8 HIGH |
| There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password. | |||||
| CVE-2016-4069 | 2 Opensuse, Roundcube | 2 Leap, Webmail | 2018-10-30 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors. | |||||
| CVE-2017-4928 | 1 Vmware | 1 Vcenter Server | 2018-10-30 | 5.0 MEDIUM | 7.5 HIGH |
| The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers towards internal services leading to information disclosure. | |||||
| CVE-2018-0647 | 1 Asus | 2 Wl-330nul, Wl-330nul Firmware | 2018-10-30 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site request forgery (CSRF) vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authentication of administrators via unspecified vectors. | |||||
| CVE-2018-16416 | 1 Thedaylightstudio | 1 Fuel Cms | 2018-10-25 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password. | |||||
| CVE-2018-16339 | 1 Phome | 1 Empirecms | 2018-10-25 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser. | |||||
| CVE-2018-16338 | 1 Auracms | 1 Auracms | 2018-10-25 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic. | |||||
| CVE-2018-16387 | 1 Elefantcms | 1 Elefantcms | 2018-10-25 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Elefant CMS before 2.0.5. There is a CSRF vulnerability that can add an account via user/add. | |||||
| CVE-2018-16448 | 1 Chshcms | 1 Cscms | 2018-10-25 | 6.8 MEDIUM | 8.8 HIGH |
| Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save. | |||||
| CVE-2018-16332 | 1 Idreamsoft | 1 Icms | 2018-10-24 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability. | |||||
| CVE-2018-16331 | 1 Damicms | 1 Damicms | 2018-10-23 | 6.8 MEDIUM | 8.8 HIGH |
| admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password. | |||||
| CVE-2018-11718 | 1 Xovis | 6 Pc2, Pc2 Firmware, Pc2r and 3 more | 2018-10-22 | 6.8 MEDIUM | 8.8 HIGH |
| Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow CSRF. | |||||
| CVE-2018-16732 | 1 Chshcms | 1 Cscms | 2018-10-19 | 6.8 MEDIUM | 8.8 HIGH |
| \upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save. | |||||
| CVE-2015-4639 | 1 Koha | 1 Koha | 2018-10-18 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web script or HTML via a crafted list name. | |||||
| CVE-2018-15851 | 1 Flexocms Project | 1 Flexo Cms | 2018-10-17 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Flexo CMS v0.1.6. There is a CSRF vulnerability that can add an administrator via /admin/user/add. | |||||
| CVE-2018-15848 | 1 Portfoliocms Project | 1 Portfoliocms | 2018-10-17 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in portfolioCMS 1.0.5. There is CSRF to create new pages via admin/portfolio.php?newpage=true. | |||||
| CVE-2018-15850 | 1 Redaxo | 1 Redaxo Cms | 2018-10-17 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user. | |||||
| CVE-2018-15844 | 1 Damicms | 1 Damicms | 2018-10-17 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit. | |||||
| CVE-2018-15846 | 1 Fledrcms Project | 1 Fledrcms | 2018-10-17 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in fledrCMS through 2014-02-03. There is a CSRF vulnerability that can change the administrator's password via index.php?p=done&savedata=1. | |||||
| CVE-2018-15845 | 1 Gleezcms | 1 Gleez Cms | 2018-10-17 | 6.8 MEDIUM | 8.8 HIGH |
| There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add. | |||||
| CVE-2015-7446 | 1 Ibm | 5 Flashsystem 9846-ac2, Flashsystem 9846-ae2, Flashsystem 9848-ac2 and 2 more | 2018-10-17 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site request forgery (CSRF) vulnerability in IBM Flash System V9000 7.4 before 7.4.1.4, 7.5 before 7.5.1.3, and 7.6 before 7.6.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. | |||||
| CVE-2018-15564 | 1 Simple-cms Project | 1 Simple Cms | 2018-10-12 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8. | |||||
| CVE-2018-15565 | 1 Simple-cms Project | 1 Simple Cms | 2018-10-12 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication for adding a page. This can also be exploited via CSRF. | |||||
| CVE-2018-14057 | 1 Pimcore | 1 Pimcore | 2018-10-12 | 6.8 MEDIUM | 8.8 HIGH |
| Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the "Settings > Users / Roles" function. | |||||
| CVE-2018-2442 | 1 Sap | 2 Businessobjects Business Intelligence, Internet Graphics Server | 2018-10-11 | 6.8 MEDIUM | 8.8 HIGH |
| In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid. | |||||
| CVE-2018-7097 | 1 Hp | 1 3par Service Provider | 2018-10-10 | 6.8 MEDIUM | 8.8 HIGH |
| A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited remotely to allow cross-site request forgery. | |||||
| CVE-2018-7060 | 1 Arubanetworks | 1 Clearpass | 2018-10-10 | 6.8 MEDIUM | 8.8 HIGH |
| Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface. | |||||
| CVE-2018-6563 | 1 Totemo | 1 Encryption Gateway | 2018-10-09 | 6.8 MEDIUM | 8.8 HIGH |
| Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentication of users for requests that (1) change user settings, (2) send emails, or (3) change contact information by leveraging lack of an anti-CSRF token. | |||||
| CVE-2016-4311 | 1 Wso2 | 1 Identity Server | 2018-10-09 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests via an entitlement/eval-policy-submit.jsp request. | |||||
| CVE-2016-0891 | 1 Emc | 1 Vipr Srm | 2018-10-09 | 6.8 MEDIUM | 8.8 HIGH |
| Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remote attackers to hijack the authentication of administrators. | |||||
| CVE-2015-8379 | 1 Cakephp | 1 Cakephp | 2018-10-09 | 6.8 MEDIUM | 8.8 HIGH |
| CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter. | |||||
| CVE-2015-2878 | 1 Watchguard | 1 Hawkeye G | 2018-10-09 | 6.8 MEDIUM | 8.8 HIGH |
| Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that (1) add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the (2) Url matching, (3) DNS Inject, or (4) IP Redirect Sensor in a request to interface/rest/dpi/setEnabled/1; or (5) perform whitelisting of malware MD5 hash IDs via the id parameter to interface/rest/md5-threats/whitelist. | |||||
| CVE-2018-15186 | 1 Chartered Accountant \ | 1 Auditor Website Project | 2018-10-09 | 6.8 MEDIUM | 8.8 HIGH |
| PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has CSRF via client/auditor/updprofile.php. | |||||
| CVE-2013-7464 | 1 Csrf-magic Project | 1 Csrf-magic | 2018-10-09 | 6.8 MEDIUM | 8.8 HIGH |
| In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used. | |||||
| CVE-2018-15187 | 1 Advanced Real Estate Script Project | 1 Advanced Real Estate Script | 2018-10-05 | 6.0 MEDIUM | 8.0 HIGH |
| PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php. | |||||