CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CSRF) (CVSS score >= 5)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-1010112 352 CSRF 2019-07-18 2019-07-22
6.8
None Remote Medium Not required Partial Partial Partial
OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery (CSRF). The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3.
2 CVE-2019-1010096 352 CSRF 2019-07-18 2019-07-18
6.8
None Remote Medium Not required Partial Partial Partial
domainmod(https://domainmod.org/) domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.
3 CVE-2019-1010095 352 CSRF 2019-07-18 2019-07-18
6.8
None Remote Medium Not required Partial Partial Partial
domainmod(https://domainmod.org/) domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: http://127.0.0.1/admin/users/add.php. The attack vector is: After the administrator logged in, open the html page.
4 CVE-2019-1010094 352 CSRF 2019-07-18 2019-07-18
6.8
None Remote Medium Not required Partial Partial Partial
domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.
5 CVE-2019-1010054 352 CSRF 2019-07-18 2019-07-18
6.8
None Remote Medium Not required Partial Partial Partial
Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.
6 CVE-2019-1003008 352 Exec Code CSRF 2019-02-06 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.
7 CVE-2019-1003007 352 Exec Code CSRF 2019-02-06 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.
8 CVE-2019-17431 352 CSRF 2019-10-10 2019-10-11
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability.
9 CVE-2019-17386 352 CSRF 2019-10-10 2019-10-15
6.8
None Remote Medium Not required Partial Partial Partial
The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php.
10 CVE-2019-17217 352 CSRF 2019-10-06 2019-10-10
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no CSRF protection established on the web service.
11 CVE-2019-16993 352 CSRF 2019-09-30 2019-10-07
6.8
None Remote Medium Not required Partial Partial Partial
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
12 CVE-2019-16721 352 CSRF 2019-09-23 2019-09-23
5.8
None Remote Medium Not required None Partial Partial
NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user.
13 CVE-2019-16706 352 CSRF 2019-09-23 2019-09-23
6.8
None Remote Medium Not required Partial Partial Partial
kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php.
14 CVE-2019-16677 352 CSRF 2019-09-21 2019-09-23
5.8
None Remote Medium Not required None Partial Partial
An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF.
15 CVE-2019-16667 352 CSRF 2019-09-26 2019-09-27
6.8
None Remote Medium Not required Partial Partial Partial
diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produces a "CSRF token expired" error and a Try Again button when a CSRF token is missing.
16 CVE-2019-16660 352 CSRF 2019-09-21 2019-09-23
6.8
None Remote Medium Not required Partial Partial Partial
joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF.
17 CVE-2019-16659 352 CSRF 2019-09-21 2019-09-23
6.8
None Remote Medium Not required Partial Partial Partial
TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF.
18 CVE-2019-16658 352 CSRF 2019-09-21 2019-09-23
6.8
None Remote Medium Not required Partial Partial Partial
TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.
19 CVE-2019-16531 352 CSRF 2019-09-19 2019-09-20
6.8
None Remote Medium Not required Partial Partial Partial
LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.
20 CVE-2019-16311 352 CSRF 2019-09-14 2019-09-16
6.8
None Remote Medium Not required Partial Partial Partial
NIUSHOP V1.11 has CSRF via search_info to index.php.
21 CVE-2019-16187 200 +Info CSRF 2019-09-09 2019-09-10
5.0
None Remote Low Not required Partial None None
Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script.
22 CVE-2019-16099 352 CSRF 2019-09-08 2019-09-09
6.8
None Remote Medium Not required Partial Partial Partial
Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows CSRF via JSON data to a .swf file.
23 CVE-2019-16059 352 CSRF 2019-09-06 2019-09-08
6.8
None Remote Medium Not required Partial Partial Partial
Sentrifugo 3.2 lacks CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code at index.php/dashboard/viewprofile via a crafted HTML page.
24 CVE-2019-15868 352 CSRF 2019-09-03 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.
25 CVE-2019-15865 352 CSRF 2019-09-03 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.
26 CVE-2019-15841 352 CSRF 2019-08-30 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility.
27 CVE-2019-15840 352 CSRF 2019-08-30 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.
28 CVE-2019-15835 352 CSRF 2019-08-30 2019-09-04
6.8
None Remote Medium Not required Partial Partial Partial
The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.
29 CVE-2019-15834 352 CSRF 2019-08-30 2019-09-04
6.8
None Remote Medium Not required Partial Partial Partial
The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.
30 CVE-2019-15832 352 CSRF 2019-08-30 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.
31 CVE-2019-15831 352 CSRF 2019-08-30 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
32 CVE-2019-15828 352 CSRF 2019-08-30 2019-09-05
6.8
None Remote Medium Not required Partial Partial Partial
The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.
33 CVE-2019-15781 352 CSRF 2019-08-29 2019-08-30
6.8
None Remote Medium Not required Partial Partial Partial
The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.
34 CVE-2019-15769 352 CSRF 2019-08-29 2019-09-05
6.8
None Remote Medium Not required Partial Partial Partial
The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.
35 CVE-2019-15660 352 CSRF 2019-08-27 2019-08-28
6.8
None Remote Medium Not required Partial Partial Partial
The wp-members plugin before 3.2.8 for WordPress has CSRF.
36 CVE-2019-15645 352 CSRF 2019-08-27 2019-08-28
6.8
None Remote Medium Not required Partial Partial Partial
The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
37 CVE-2019-15496 352 CSRF 2019-08-28 2019-08-30
6.8
None Remote Medium Not required Partial Partial Partial
MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.
38 CVE-2019-15491 352 CSRF 2019-08-23 2019-08-26
6.8
None Remote Medium Not required Partial Partial Partial
openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.
39 CVE-2019-15329 352 CSRF 2019-08-22 2019-08-23
6.8
None Remote Medium Not required Partial Partial Partial
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.
40 CVE-2019-15238 352 CSRF 2019-08-20 2019-08-22
6.8
None Remote Medium Not required Partial Partial Partial
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
41 CVE-2019-15229 352 CSRF 2019-08-19 2019-08-26
6.8
None Remote Medium Not required Partial Partial Partial
FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.
42 CVE-2019-15150 352 CSRF 2019-08-19 2019-08-26
6.8
None Remote Medium Not required Partial Partial Partial
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.
43 CVE-2019-15115 352 CSRF 2019-08-16 2019-08-22
6.8
None Remote Medium Not required Partial Partial Partial
The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.
44 CVE-2019-15114 352 CSRF 2019-08-16 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.
45 CVE-2019-15113 352 CSRF 2019-08-16 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.
46 CVE-2019-15089 352 CSRF 2019-09-20 2019-09-20
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator.
47 CVE-2019-15062 352 Bypass CSRF 2019-08-14 2019-08-28
6.0
None Remote Medium Single system Partial Partial Partial
An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)
48 CVE-2019-15040 352 CSRF 2019-10-02 2019-10-03
6.8
None Remote Medium Not required Partial Partial Partial
JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.
49 CVE-2019-14933 352 CSRF 2019-08-11 2019-08-14
6.8
None Remote Medium Not required Partial Partial Partial
Bagisto 0.1.5 allows CSRF under /admin URIs.
50 CVE-2019-14703 352 CSRF 2019-08-06 2019-08-13
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF issue was discovered in webparam?user&action=set&param=add in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 to create an admin account.
Total number of vulnerabilities : 2149   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.