CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CSRF)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
751 CVE-2017-17550 352 XSS CSRF 2018-11-10 2018-12-13
6.8
None Remote Medium Not required Partial Partial Partial
ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS.
752 CVE-2017-17056 352 CSRF 2017-12-04 2017-12-20
6.8
None Remote Medium Not required Partial Partial Partial
The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'password_change()' function of the Modify Password component, reachable via the old_password, new_password1, and new_password2 parameters to the /accounts/password_change/ URI. An attacker takes advantage of this scenario and creates a crafted CSRF link to add himself as an administrator to the ZKTime Web Software. He then uses social engineering methods to trick the administrator into clicking the forged HTTP request. The request is executed and the attacker becomes the Administrator of the ZKTime Web Software. If the vulnerability is successfully exploited, then an attacker (who would be a normal user of the web application) can escalate his privileges and become the administrator of ZKTime Web Software.
753 CVE-2017-16908 79 Exec Code XSS Bypass CSRF 2017-11-20 2019-05-07
3.5
None Remote Medium Single system None Partial None
In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising an administrator account, because the CVE-2015-7984 CSRF protection mechanism can then be bypassed.
754 CVE-2017-16886 352 CSRF 2018-01-12 2018-02-02
6.8
None Remote Medium Not required Partial Partial Partial
The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access to Web Services via CSRF can result in an unauthorized change of username or password of the administrator of the portal.
755 CVE-2017-16862 352 CSRF 2018-01-12 2018-01-31
4.3
None Remote Medium Not required None Partial None
The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery (CSRF) vulnerability.
756 CVE-2017-16756 352 CSRF 2018-02-19 2018-03-09
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account.
757 CVE-2017-16653 CSRF 2018-08-06 2019-10-02
4.3
None Remote Medium Not required Partial None None
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks.
758 CVE-2017-16570 352 Bypass CSRF 2017-11-06 2018-01-30
6.8
None Remote Medium Not required Partial Partial Partial
KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.
759 CVE-2017-16565 352 CSRF 2017-11-06 2017-11-27
6.8
None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests.
760 CVE-2017-16563 352 CSRF 2017-11-06 2017-11-27
6.0
None Remote Medium Single system Partial Partial Partial
Cross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream) HT802 devices allows attackers to modify settings, related to cgi-bin/update.
761 CVE-2017-16244 352 Bypass CSRF 2017-10-31 2017-11-17
6.8
None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.
762 CVE-2017-15911 79 Exec Code XSS Bypass CSRF 2017-10-26 2017-11-17
3.5
None Remote Medium Single system None Partial None
The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.
763 CVE-2017-15808 352 CSRF 2017-10-23 2017-10-25
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.
764 CVE-2017-15735 352 CSRF 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary.
765 CVE-2017-15734 352 CSRF 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php.
766 CVE-2017-15733 352 CSRF 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php.
767 CVE-2017-15732 352 CSRF 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php.
768 CVE-2017-15731 352 CSRF 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php.
769 CVE-2017-15730 352 CSRF 2017-10-22 2017-10-31
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
770 CVE-2017-15729 352 CSRF 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary.
771 CVE-2017-15645 352 Exec Code CSRF 2017-10-19 2017-11-07
6.8
None Remote Medium Not required Partial Partial Partial
CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands.
772 CVE-2017-15608 352 CSRF 2018-09-26 2018-11-23
4.3
None Remote Medium Not required None Partial None
Inedo ProGet before 5.0 Beta5 has CSRF, allowing an attacker to change advanced settings.
773 CVE-2017-15516 352 CSRF 2017-11-16 2017-12-02
6.8
None Remote Medium Not required Partial Partial Partial
NetApp SnapCenter Server versions 1.1 through 2.x are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability which could be used to cause an unintended authenticated action in the user interface.
774 CVE-2017-15362 79 Exec Code XSS Bypass CSRF 2017-10-15 2017-11-07
4.3
None Remote Medium Not required None Partial None
osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application. This affects a different tickets.php file than CVE-2015-1176.
775 CVE-2017-15296 352 CSRF 2017-10-16 2018-12-10
6.8
None Remote Medium Not required Partial Partial Partial
The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964.
776 CVE-2017-15084 352 CSRF 2017-10-06 2017-10-13
4.3
None Remote Medium Not required None None Partial
The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22.
777 CVE-2017-15063 352 CSRF 2017-10-06 2018-11-08
6.8
None Remote Medium Not required Partial Partial Partial
There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing (for example) an attack against the query parameter to panel/database.
778 CVE-2017-14956 352 CSRF 2017-10-18 2019-05-13
3.5
None Remote Medium Single system Partial None None
AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/ossim/report/wizard_email.php" script. Besides offering an export via a local download, the script also offers the possibility to send out any report via email to a given address (either in PDF or XLS format). Since there is no anti-CSRF token protecting this functionality, it is vulnerable to Cross-Site Request Forgery attacks.
779 CVE-2017-14925 352 CSRF 2017-09-29 2017-10-06
6.0
None Remote Medium Single system Partial Partial Partial
Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to edit global permissions if an administrator opens a wiki page with an IMG element, related to tiki-objectpermissions.php. For example, an attacker could assign administrator privileges to every unauthenticated user of the site.
780 CVE-2017-14924 352 +Priv CSRF 2017-09-29 2017-10-06
6.0
None Remote Medium Single system Partial Partial Partial
Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to tiki-assignuser.php.
781 CVE-2017-14683 352 CSRF 2017-09-25 2017-09-28
6.8
None Remote Medium Not required Partial Partial Partial
geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.
782 CVE-2017-14530 352 XSS CSRF 2017-09-17 2017-09-28
6.0
None Remote Medium Single system Partial Partial Partial
WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences.
783 CVE-2017-14362 352 CSRF 2017-12-12 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability could be exploited to allow a Cross-Site Forgery attack.
784 CVE-2017-14267 352 CSRF 2017-09-11 2017-09-15
6.8
None Remote Medium Not required Partial Partial Partial
EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings.
785 CVE-2017-14092 352 CSRF 2017-12-15 2017-12-26
6.8
None Remote Medium Not required Partial Partial Partial
The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain.
786 CVE-2017-14048 352 CSRF 2017-08-31 2017-09-01
6.5
None Remote Low Single system Partial Partial Partial
BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. NOTE: this can be exploited via CSRF.
787 CVE-2017-14011 352 Exec Code CSRF 2017-10-17 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A Cross-Site Request Forgery issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The application does not sufficiently verify requests, making it susceptible to cross-site request forgery. This may allow an attacker to execute unauthorized code, resulting in changes to the configuration of the device.
788 CVE-2017-13129 352 CSRF 2017-09-26 2017-10-03
6.0
None Remote Medium Single system Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that add administrators by leveraging lack of anti-CSRF tokens.
789 CVE-2017-12970 352 CSRF 2017-08-23 2019-05-03
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of authenticated users for requests that (1) add or (2) delete user accounts via a request to phpsftpd/users.php.
790 CVE-2017-12949 89 Sql CSRF 2017-08-18 2017-08-24
6.5
None Remote Low Single system Partial Partial Partial
lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF.
791 CVE-2017-12881 352 CSRF 2017-08-18 2017-08-24
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability.
792 CVE-2017-12853 352 CSRF 2017-08-14 2017-08-25
6.8
None Remote Medium Not required Partial Partial Partial
The RealTime RWR-3G-100 Router Firmware Version : Ver1.0.56 is affected by CSRF an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.
793 CVE-2017-12838 352 CSRF 2017-09-07 2017-09-13
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests that (1) send manas via a request to mybonus.php or (2) add administrators via unspecified vectors.
794 CVE-2017-12792 79 XSS CSRF 2017-10-02 2017-10-13
4.3
None Remote Medium Not required None Partial None
Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) linkname, (2) url, or (3) title parameter in an add action to linksmanage.php.
795 CVE-2017-12790 352 CSRF 2019-05-09 2019-05-09
4.3
None Remote Medium Not required Partial None None
Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state.
796 CVE-2017-12789 352 CSRF 2019-05-10 2019-05-13
6.8
None Remote Medium Not required Partial Partial Partial
Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/interface/online/delete.php. The attack vector is: The administrator clicks on the malicious link in the login state.
797 CVE-2017-12703 352 CSRF 2017-08-25 2017-08-29
6.8
None Remote Medium Not required Partial Partial Partial
A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The application does not verify whether a request was intentionally provided by the user, making it possible for an attacker to trick a user into making a malicious request to the server.
798 CVE-2017-12651 352 CSRF 2017-08-07 2017-08-15
6.8
None Remote Medium Not required Partial Partial Partial
Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HTTP Referer header is not checked.
799 CVE-2017-12631 352 CSRF 2017-11-30 2018-03-27
6.8
None Remote Medium Not required Partial Partial Partial
Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a security context that is set up using a malicious client's roles for the given enduser.
800 CVE-2017-12593 352 CSRF 2017-08-18 2017-08-24
6.8
None Remote Medium Not required Partial Partial Partial
ASUS DSL-N10S V2.1.16_APAC devices allow CSRF.
Total number of vulnerabilities : 2521   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 (This Page)17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.