CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2017(CSRF)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-1002150 CSRF 2017-09-14 2017-09-14
0.0
None ??? ??? ??? ??? ??? ???
python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection
2 CVE-2017-1000069 352 CSRF 2017-07-17 2017-07-20
6.8
None Remote Medium Not required Partial Partial Partial
CSRF in Bitly oauth2_proxy 2.1 during authentication flow
3 CVE-2017-1000045 352 Bypass CSRF 2017-07-17 2017-07-26
6.8
None Remote Medium Not required Partial Partial Partial
Mautic SSO/OAuth2 plugins are vulnerable to CSRF of the state parameter resulting in authentication bypass through clickjacking
4 CVE-2017-1000008 352 CSRF 2017-07-17 2017-08-07
6.8
None Remote Medium Not required Partial Partial Partial
Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify account information, including their password.
5 CVE-2017-14530 XSS CSRF 2017-09-17 2017-09-17
0.0
None ??? ??? ??? ??? ??? ???
WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences.
6 CVE-2017-14267 352 CSRF 2017-09-11 2017-09-15
6.8
None Remote Medium Not required Partial Partial Partial
EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings.
7 CVE-2017-14048 352 CSRF 2017-08-31 2017-09-01
6.5
None Remote Low Single system Partial Partial Partial
BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. NOTE: this can be exploited via CSRF.
8 CVE-2017-12970 352 CSRF 2017-08-23 2017-09-05
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of authenticated users for requests that (1) add or (2) delete user accounts via a request to phpsftpd/users.php.
9 CVE-2017-12949 89 Sql CSRF 2017-08-18 2017-08-24
6.5
None Remote Low Single system Partial Partial Partial
lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF.
10 CVE-2017-12881 352 CSRF 2017-08-18 2017-08-24
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability.
11 CVE-2017-12853 352 CSRF 2017-08-14 2017-08-25
6.8
None Remote Medium Not required Partial Partial Partial
The RealTime RWR-3G-100 Router Firmware Version : Ver1.0.56 is affected by CSRF an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.
12 CVE-2017-12838 352 CSRF 2017-09-07 2017-09-13
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests that (1) send manas via a request to mybonus.php or (2) add administrators via unspecified vectors.
13 CVE-2017-12703 352 CSRF 2017-08-25 2017-08-29
6.8
None Remote Medium Not required Partial Partial Partial
A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The application does not verify whether a request was intentionally provided by the user, making it possible for an attacker to trick a user into making a malicious request to the server.
14 CVE-2017-12651 352 CSRF 2017-08-07 2017-08-15
6.8
None Remote Medium Not required Partial Partial Partial
Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HTTP Referer header is not checked.
15 CVE-2017-12593 352 CSRF 2017-08-18 2017-08-24
6.8
None Remote Medium Not required Partial Partial Partial
ASUS DSL-N10S V2.1.16_APAC devices allow CSRF.
16 CVE-2017-12589 352 CSRF 2017-08-18 2017-08-26
6.8
None Remote Medium Not required Partial Partial Partial
ToMAX R60G R60GV2-V2.0-v.2.6.3-170330 devices do not have any protection against a CSRF attack.
17 CVE-2017-12584 352 CSRF 2017-08-05 2017-08-14
6.8
None Remote Medium Not required Partial Partial Partial
There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile (including the password) can be updated without sending the current password. This allows remote attackers to trick a user into changing to an attacker-controlled password, a complete account takeover, via the passwd1 and passwd2 fields in an admin/modules/system/app_user.php changecurrent=true operation.
18 CVE-2017-11726 352 CSRF 2017-07-31 2017-08-04
6.8
None Remote Medium Not required Partial Partial Partial
services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstrated by changing an e-mail address setting.
19 CVE-2017-11680 352 CSRF 2017-07-27 2017-08-02
6.8
None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery (CSRF) exists in Hashtopussy 0.4.0, allowing an admin password change via users.php.
20 CVE-2017-11679 352 CSRF 2017-07-27 2017-08-03
6.8
None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery (CSRF) exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action.
21 CVE-2017-11648 352 CSRF 2017-07-31 2017-08-04
6.8
None Remote Medium Not required Partial Partial Partial
Techroutes TR 1803-3G Wireless Cellular Router/Modem 2.4.25 devices do not possess any protection against a CSRF vulnerability, as demonstrated by a goform/BasicSettings request to disable port filtering.
22 CVE-2017-11646 352 CSRF 2017-07-28 2017-08-04
6.8
None Remote Medium Not required Partial Partial Partial
NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to CSRF attacks, as demonstrated by using administration.html to disable the firewall. They does not contain any token that can mitigate CSRF vulnerabilities within the device.
23 CVE-2017-11567 352 Exec Code CSRF 2017-09-07 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to __mg_admin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely.
24 CVE-2017-11455 352 CSRF 2017-08-29 2017-09-12
6.8
None Remote Medium Not required Partial Partial Partial
diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CSRF tokens.
25 CVE-2017-11350 CSRF 2017-09-13 2017-09-13
0.0
None ??? ??? ??? ??? ??? ???
Cross-Site Request Forgery (CSRF) exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices.
26 CVE-2017-11196 352 CSRF 2017-07-12 2017-07-18
6.8
None Remote Medium Not required Partial Partial Partial
Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page.
27 CVE-2017-11193 352 CSRF 2017-07-12 2017-07-19
6.8
None Remote Medium Not required Partial Partial Partial
Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker to run these commands against any IP if they can get an admin to visit their malicious CSRF page.
28 CVE-2017-10961 352 CSRF 2017-07-18 2017-07-24
6.8
None Remote Medium Not required Partial Partial Partial
REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload components.
29 CVE-2017-10711 79 XSS CSRF 2017-07-24 2017-08-10
4.3
None Remote Medium Not required None Partial None
In SimpleRisk 20170614-001, a CSRF attack on reset.php (aka the Send Password Reset Email form) can insert XSS sequences via the user parameter.
30 CVE-2017-10681 352 CSRF 2017-06-29 2017-07-04
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock albums via a crafted request.
31 CVE-2017-10680 352 CSRF 2017-06-29 2017-07-03
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a private album to public via a crafted request.
32 CVE-2017-10678 352 CSRF 2017-06-29 2017-07-05
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request.
33 CVE-2017-10677 352 CSRF 2017-08-06 2017-08-14
6.8
None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery (CSRF) exists on Linksys EA4500 devices with Firmware Version before 2.1.41.164606, as demonstrated by a request to apply.cgi to disable SIP.
34 CVE-2017-9934 79 XSS CSRF 2017-07-17 2017-07-21
4.3
None Remote Medium Not required None Partial None
Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability.
35 CVE-2017-9930 352 CSRF 2017-07-21 2017-07-25
6.8
None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery (CSRF) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by a request to ajax.cgi that enables UPnP.
36 CVE-2017-9863 352 CSRF 2017-08-05 2017-08-21
6.8
None Remote Medium Not required Partial Partial Partial
** DISPUTED ** An issue was discovered in SMA Solar Technology products. If a user simultaneously has Sunny Explorer running and visits a malicious host, cross-site request forgery can be used to change settings in the inverters (for example, issuing a POST request to change the user password). All Sunny Explorer settings available to the authenticated user are also available to the attacker. (In some cases, this also includes changing settings that the user has no access to.) This may result in complete compromise of the device. NOTE: the vendor reports that exploitation is unlikely because Sunny Explorer is used only rarely. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected.
37 CVE-2017-9810 254 CSRF 2017-07-17 2017-08-11
6.8
None Remote Medium Not required Partial Partial Partial
There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain.
38 CVE-2017-9785 502 Exec Code CSRF 2017-07-20 2017-07-25
7.5
None Remote Low Not required Partial Partial Partial
Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie.
39 CVE-2017-9757 77 CSRF 2017-06-19 2017-06-28
6.5
None Remote Low Single system Partial Partial Partial
IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. This can be exploited directly by authenticated users, or through CSRF.
40 CVE-2017-9673 352 CSRF 2017-06-15 2017-06-22
6.8
None Remote Medium Not required Partial Partial Partial
In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account (via the index.php/user/new URI) or change its settings (via the index.php/user/1 URI), including its password.
41 CVE-2017-9519 352 CSRF 2017-06-08 2017-06-13
6.8
None Remote Medium Not required Partial Partial Partial
atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account.
42 CVE-2017-9518 352 CSRF 2017-06-08 2017-06-13
6.8
None Remote Medium Not required Partial Partial Partial
atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails.
43 CVE-2017-9517 352 CSRF 2017-06-08 2017-06-13
6.8
None Remote Medium Not required Partial Partial Partial
atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV.
44 CVE-2017-9490 352 CSRF 2017-07-30 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
The Comcast firmware on Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows configuration changes via CSRF.
45 CVE-2017-9489 352 CSRF 2017-07-30 2017-08-02
6.8
None Remote Medium Not required Partial Partial Partial
The Comcast firmware on Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST) devices allows configuration changes via CSRF.
46 CVE-2017-9444 352 CSRF 2017-06-05 2017-06-12
6.8
None Remote Medium Not required Partial Partial Partial
BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/developer/upgrade/ignore/?versions= URI, and the index.php/admin/developer/upgrade/set-ftp-directory/ URI.
47 CVE-2017-9415 352 CSRF 2017-07-21 2017-07-25
5.1
None Remote High Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view.
48 CVE-2017-9413 352 CSRF 2017-07-25 2017-07-28
6.8
None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that (1) subscribe to a podcast via the add parameter to podcastReceiverAdmin.view or (2) update Internet Radio Settings via the urlRedirectCustomUrl parameter to networkSettings.view. NOTE: These vulnerabilities can be exploited to conduct server-side request forgery (SSRF) attacks.
49 CVE-2017-9379 352 CSRF 2017-06-02 2017-06-06
6.8
None Remote Medium Not required Partial Partial Partial
Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to core\admin\modules\dashboard\vitals-statistics\404\create-301.php.
50 CVE-2017-9365 352 CSRF 2017-06-02 2017-06-06
6.8
None Remote Medium Not required Partial Partial Partial
CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false. A page with id=1 can be unlocked.
Total number of vulnerabilities : 242   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.