CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CSRF)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
701 CVE-2017-1000504 352 Exec Code CSRF 2018-01-24 2019-05-08
6.8
None Remote Medium Not required Partial Partial Partial
A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.
702 CVE-2017-1000499 352 CSRF 2018-01-03 2019-04-30
6.8
None Remote Medium Not required Partial Partial Partial
phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.
703 CVE-2017-1000479 352 Exec Code CSRF 2018-01-03 2019-05-30
6.8
None Remote Medium Not required Partial Partial Partial
pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not vulnerable since version 16.1.16 released on June 06, 2016. The unprotected web form was removed from the code during an internal security audit under "possibly insecure" suspicions.
704 CVE-2017-1000432 352 CSRF 2018-01-02 2018-01-17
6.0
None Remote Medium Single system Partial Partial Partial
Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access
705 CVE-2017-1000389 79 XSS CSRF 2018-01-25 2018-02-12
4.3
None Remote Medium Not required None Partial None
Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could have been interpreted as HTML by clients, resulting in a potential reflected cross-site scripting vulnerability. Additionally, some URLs provided by global-build-stats plugin that modify data did not require POST requests to be sent, resulting in a potential cross-site request forgery vulnerability.
706 CVE-2017-1000244 352 CSRF 2017-11-01 2019-05-22
6.8
None Remote Medium Not required Partial Partial Partial
Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification
707 CVE-2017-1000224 352 CSRF 2017-11-16 2017-12-03
4.3
None Remote Medium Not required None Partial None
CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin
708 CVE-2017-1000147 352 CSRF 2017-11-03 2017-11-15
6.0
None Remote Medium Single system Partial Partial Partial
Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery (CSRF) attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into their Mahara account.
709 CVE-2017-1000093 352 CSRF 2017-10-04 2017-10-17
6.8
None Remote Medium Not required Partial Partial Partial
Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy action as it's similar to cache invalidation, the plugin specifically adds a permission to be able to use this functionality, and this issue undermines that permission.
710 CVE-2017-1000091 352 CSRF 2017-10-04 2017-10-17
6.8
None Remote Medium Not required Partial Partial Partial
GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan Credentials are correct). This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect to any web server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery.
711 CVE-2017-1000090 352 CSRF 2017-10-04 2017-11-02
6.8
None Remote Medium Not required Partial Partial Partial
Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access to Jenkins.
712 CVE-2017-1000086 732 CSRF 2017-10-04 2019-10-02
6.0
None Remote Medium Single system Partial Partial Partial
The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.
713 CVE-2017-1000085 352 CSRF 2017-10-04 2017-11-02
4.3
None Remote Medium Not required Partial None None
Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks.
714 CVE-2017-1000069 352 CSRF 2017-07-17 2017-07-20
6.8
None Remote Medium Not required Partial Partial Partial
CSRF in Bitly oauth2_proxy 2.1 during authentication flow
715 CVE-2017-1000045 352 Bypass CSRF 2017-07-17 2017-07-26
6.8
None Remote Medium Not required Partial Partial Partial
Mautic SSO/OAuth2 plugins are vulnerable to CSRF of the state parameter resulting in authentication bypass through clickjacking
716 CVE-2017-1000008 352 CSRF 2017-07-17 2017-08-07
6.8
None Remote Medium Not required Partial Partial Partial
Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify account information, including their password.
717 CVE-2017-18607 352 CSRF 2019-09-10 2019-09-10
6.8
None Remote Medium Not required Partial Partial Partial
The avada theme before 5.1.5 for WordPress has CSRF.
718 CVE-2017-18569 352 CSRF 2019-08-20 2019-08-22
6.8
None Remote Medium Not required Partial Partial Partial
The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.
719 CVE-2017-18547 352 CSRF 2019-08-16 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
720 CVE-2017-18546 352 CSRF 2019-08-16 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.
721 CVE-2017-18544 352 CSRF 2019-08-16 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
722 CVE-2017-18523 352 CSRF 2019-08-20 2019-08-22
6.8
None Remote Medium Not required Partial Partial Partial
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.
723 CVE-2017-18521 352 CSRF 2019-08-21 2019-08-23
6.8
None Remote Medium Not required Partial Partial Partial
The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.
724 CVE-2017-18513 352 CSRF 2019-08-14 2019-08-20
6.8
None Remote Medium Not required Partial Partial Partial
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
725 CVE-2017-18512 352 CSRF 2019-08-14 2019-08-20
6.8
None Remote Medium Not required Partial Partial Partial
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
726 CVE-2017-18511 352 CSRF 2019-08-14 2019-08-20
6.8
None Remote Medium Not required Partial Partial Partial
The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.
727 CVE-2017-18510 352 CSRF 2019-08-14 2019-08-20
6.8
None Remote Medium Not required Partial Partial Partial
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
728 CVE-2017-18504 352 CSRF 2019-08-12 2019-08-16
6.8
None Remote Medium Not required Partial Partial Partial
The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.
729 CVE-2017-18485 352 CSRF 2019-08-08 2019-08-15
5.8
None Remote Medium Not required Partial Partial None
Cognitoys Dino devices allow profiles_add.html CSRF.
730 CVE-2017-18366 352 CSRF 2019-04-15 2019-04-15
6.8
None Remote Medium Not required Partial Partial Partial
Subrion CMS 4.1.5 has CSRF in blog/delete/.
731 CVE-2017-18081 79 XSS CSRF 2018-02-02 2019-04-26
4.3
None Remote Medium Not required None Partial None
The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the value of the csrf token cookie.
732 CVE-2017-18080 352 CSRF 2018-02-02 2018-02-13
6.8
None Remote Medium Not required Partial Partial Partial
The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forgery (CSRF) vulnerability.
733 CVE-2017-18042 352 CSRF 2018-02-02 2019-04-29
6.8
None Remote Medium Not required Partial Partial Partial
The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery (CSRF) vulnerability.
734 CVE-2017-18033 352 CSRF 2018-01-18 2018-02-05
4.3
None Remote Medium Not required None Partial None
The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abort an executing external system import via various Cross-site request forgery (CSRF) vulnerabilities.
735 CVE-2017-17990 352 CSRF 2017-12-29 2018-01-09
6.8
None Remote Medium Not required Partial Partial Partial
Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action.
736 CVE-2017-17982 352 CSRF 2017-12-29 2018-01-09
6.0
None Remote Medium Single system Partial Partial Partial
PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php.
737 CVE-2017-17960 352 CSRF 2017-12-28 2018-04-12
6.8
None Remote Medium Not required Partial Partial Partial
PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php.
738 CVE-2017-17939 352 CSRF 2017-12-28 2018-01-09
6.8
None Remote Medium Not required Partial Partial Partial
PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.
739 CVE-2017-17936 352 CSRF 2017-12-28 2018-01-10
6.8
None Remote Medium Not required Partial Partial Partial
Vanguard Marketplace Digital Products PHP has CSRF via /search.
740 CVE-2017-17930 352 CSRF 2017-12-27 2018-01-10
6.8
None Remote Medium Not required Partial Partial Partial
PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel.
741 CVE-2017-17908 352 CSRF 2017-12-27 2018-01-10
6.8
None Remote Medium Not required Partial Partial Partial
PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general.
742 CVE-2017-17905 352 CSRF 2017-12-27 2018-01-10
6.8
None Remote Medium Not required Partial Partial Partial
PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php.
743 CVE-2017-17903 352 CSRF 2017-12-27 2018-01-09
6.8
None Remote Medium Not required Partial Partial Partial
FS Lynda Clone has CSRF via user/edit_profile, as demonstrated by adding content to the user panel.
744 CVE-2017-17894 352 CSRF 2017-12-27 2018-01-09
6.8
None Remote Medium Not required Partial Partial Partial
Readymade Job Site Script has CSRF via the /job URI.
745 CVE-2017-17891 352 CSRF 2017-12-27 2018-01-09
6.8
None Remote Medium Not required Partial Partial Partial
Readymade Video Sharing Script has CSRF via user-profile-edit.php.
746 CVE-2017-17835 CSRF 2019-01-23 2019-01-23
0.0
None ??? ??? ??? ??? ??? ???
In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.
747 CVE-2017-17830 352 CSRF 2017-12-21 2018-01-03
6.0
None Remote Medium Single system Partial Partial Partial
Bus Booking Script has CSRF via admin/new_master.php.
748 CVE-2017-17827 352 CSRF 2017-12-20 2018-01-03
6.8
None Remote Medium Not required Partial Partial Partial
Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions.
749 CVE-2017-17774 352 CSRF 2017-12-19 2018-01-04
6.8
None Remote Medium Not required Partial Partial Partial
admin/configuration.php in Piwigo 2.9.2 has CSRF.
750 CVE-2017-17552 352 Bypass CSRF 2018-02-07 2018-03-13
6.8
None Remote Medium Not required Partial Partial Partial
/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted.
Total number of vulnerabilities : 2521   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 (This Page)16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.