CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CSRF)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
351 CVE-2018-18420 352 CSRF 2018-10-19 2018-12-04
6.8
None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent URI.
352 CVE-2018-18317 352 CSRF 2018-10-15 2018-11-27
6.8
None Remote Medium Not required Partial Partial Partial
DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI.
353 CVE-2018-18316 352 CSRF 2018-10-15 2018-11-27
6.8
None Remote Medium Not required Partial Partial Partial
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI.
354 CVE-2018-18246 352 CSRF 2018-12-17 2019-01-04
4.3
None Remote Medium Not required None Partial None
Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module.
355 CVE-2018-18215 352 CSRF 2018-10-11 2018-11-21
6.8
None Remote Medium Not required Partial Partial Partial
In youke365 v1.1.5, admin/user.html has a CSRF vulnerability that can add an user account.
356 CVE-2018-18201 352 CSRF 2018-10-09 2018-11-27
6.8
None Remote Medium Not required Partial Partial Partial
qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account.
357 CVE-2018-18191 352 CSRF 2018-10-09 2018-11-21
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password.
358 CVE-2018-17986 352 CSRF 2018-10-04 2018-11-27
6.8
None Remote Medium Not required Partial Partial Partial
rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.
359 CVE-2018-17869 352 CSRF 2018-10-01 2018-11-27
6.8
None Remote Medium Not required Partial Partial Partial
DASAN H660GW devices do not implement any CSRF protection mechanism.
360 CVE-2018-17858 352 CSRF 2018-10-09 2018-11-26
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Joomla! before 3.8.13. com_installer actions do not have sufficient CSRF hardening in the backend.
361 CVE-2018-17826 352 Exec Code CSRF 2018-10-01 2018-11-16
6.8
None Remote Medium Not required Partial Partial Partial
HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then use that account to execute arbitrary PHP code by leveraging app/common/model/AdminAnnex.php to add .php to the default list of allowable file-upload types (.jpg, .png, .gif, .jpeg, and .ico).
362 CVE-2018-17792 352 CSRF 2019-07-19 2019-09-26
6.8
None Remote Medium Not required Partial Partial Partial
MDaemon Webmail (formerly WorldClient) has CSRF.
363 CVE-2018-17789 352 CSRF 2019-09-20 2019-09-30
4.3
None Remote Medium Not required None Partial None
Prospecta Master Data Online (MDO) allows CSRF.
364 CVE-2018-17584 352 CSRF 2019-04-15 2019-09-07
6.8
None Remote Medium Not required Partial Partial Partial
The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page.
365 CVE-2018-17389 352 CSRF 2019-06-19 2019-06-20
6.8
None Remote Medium Not required Partial Partial Partial
CSRF exists in server.php in Live Call Support Application 1.5 for adding an admin account.
366 CVE-2018-17387 352 CSRF 2019-06-19 2019-06-21
6.8
None Remote Medium Not required Partial Partial Partial
CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account.
367 CVE-2018-17366 352 CSRF 2018-09-23 2018-11-09
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.
368 CVE-2018-17208 78 Exec Code CSRF 2018-09-19 2019-10-02
9.3
None Remote Medium Not required Complete Complete Complete
Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi (scripts that can be discovered with binwalk on the firmware, but are not visible in the web interface). This occurs because shell metacharacters in the query string are mishandled by ShellExecute, as demonstrated by the zbtest.cgi?cmd=level&level= substring. This can also be exploited via CSRF.
369 CVE-2018-17195 352 CSRF 2018-12-19 2019-01-11
5.1
None Remote High Not required Partial Partial Partial
The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access, and injecting malicious code into an unprotected (plaintext HTTP) website which the targeted user later visits, but the possible damage warranted a Severe severity level. Mitigation: The fix to apply Cross-Origin Resource Sharing (CORS) policy request filtering was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
370 CVE-2018-17168 352 CSRF 2019-04-18 2019-04-19
4.3
None Remote Medium Not required None Partial None
PrinterOn Enterprise 4.1.4 contains multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page. For example, an administrator, by following a link, can be tricked into making unwanted changes to a printer (Disable, Approve, etc).
371 CVE-2018-17104 352 CSRF 2018-09-16 2018-11-20
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Microweber 1.0.7. There is a CSRF attack (against the admin user) that can add an administrative account via api/save_user.
372 CVE-2018-17103 352 CSRF 2018-09-16 2018-11-28
6.8
None Remote Medium Not required Partial Partial Partial
** DISPUTED ** An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter.
373 CVE-2018-17102 352 CSRF 2018-09-16 2018-11-21
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2. A CSRF vulnerability can change the administrator password via the user/me URI.
374 CVE-2018-17081 352 CSRF 2018-09-26 2018-11-26
4.3
None Remote Medium Not required None Partial None
e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arbitrary page.
375 CVE-2018-17070 352 CSRF 2018-09-15 2018-11-15
4.3
None Remote Medium Not required None Partial None
An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay.
376 CVE-2018-17069 352 CSRF 2018-09-15 2018-11-15
4.3
None Remote Medium Not required None Partial None
An issue was discovered in UNL-CMS 7.59. A CSRF attack can create new content via ?q=node%2Fadd%2Farticle&render=overlay&render=overlay.
377 CVE-2018-17045 352 CSRF 2018-09-14 2018-11-28
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in CMS MaeloStore V.1.5.0. There is a CSRF vulnerability that can change the administrator password via admin/modul/users/aksi_users.php?act=update.
378 CVE-2018-17023 352 CSRF 2018-09-13 2018-11-07
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm.
379 CVE-2018-16966 352 CSRF 2019-04-15 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
380 CVE-2018-16952 352 CSRF 2018-09-17 2018-12-07
6.8
None Remote Medium Not required Partial Partial Partial
The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. The impact is sensitive actions in the portal (such as changing a portal user's password). NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
381 CVE-2018-16951 352 Exec Code CSRF 2018-09-11 2018-11-02
6.0
None Remote Medium Single system Partial Partial Partial
xunfeng 0.2.0 allows command execution via CSRF because masscan.py mishandles backquote characters, a related issue to CVE-2018-16832.
382 CVE-2018-16887 79 Exec Code +Priv XSS CSRF 2019-01-12 2019-05-14
3.5
None Remote Medium Single system None Partial None
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
383 CVE-2018-16861 79 Exec Code +Priv XSS CSRF 2018-12-07 2019-05-14
3.5
None Remote Medium Single system None Partial None
A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.
384 CVE-2018-16854 352 CSRF 2018-11-26 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.
385 CVE-2018-16832 352 CSRF 2018-09-11 2018-12-19
4.3
None Remote Medium Not required None Partial None
CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header.
386 CVE-2018-16732 352 CSRF 2018-09-08 2018-10-19
6.8
None Remote Medium Not required Partial Partial Partial
\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save.
387 CVE-2018-16650 352 CSRF 2018-09-07 2018-11-02
6.8
None Remote Medium Not required Partial Partial Partial
phpMyFAQ before 2.9.11 allows CSRF.
388 CVE-2018-16634 352 CSRF 2018-12-04 2018-12-27
6.8
None Remote Medium Not required Partial Partial Partial
Pluck v4.7.7 allows CSRF via admin.php?action=settings.
389 CVE-2018-16552 352 CSRF 2018-09-05 2018-10-25
6.8
None Remote Medium Not required Partial Partial Partial
MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs.
390 CVE-2018-16458 352 CSRF 2018-09-04 2018-10-24
4.3
None Remote Medium Not required None Partial None
An issue was discovered in baigo CMS v2.1.1. There is an index.php?m=article&c=request CSRF that can cause publication of any article.
391 CVE-2018-16449 352 CSRF 2018-09-04 2018-10-04
4.3
None Remote Medium Not required None Partial None
OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit state via admin.php?s=/Article/setStatus/status/1.html.
392 CVE-2018-16448 352 CSRF 2018-09-04 2018-10-24
6.8
None Remote Medium Not required Partial Partial Partial
Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save.
393 CVE-2018-16447 352 CSRF 2018-09-04 2018-12-31
6.8
None Remote Medium Not required Partial Partial Partial
Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF.
394 CVE-2018-16431 352 CSRF 2018-09-03 2018-11-02
6.8
None Remote Medium Not required Partial Partial Partial
admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account.
395 CVE-2018-16416 352 CSRF 2018-09-03 2018-10-25
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password.
396 CVE-2018-16387 352 CSRF 2018-09-02 2018-10-24
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Elefant CMS before 2.0.5. There is a CSRF vulnerability that can add an account via user/add.
397 CVE-2018-16380 352 CSRF 2018-09-02 2019-09-23
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Ogma CMS 0.4 Beta. There is a CSRF vulnerability in users.php?action=createnew that can add an admin account.
398 CVE-2018-16366 352 CSRF 2018-09-02 2019-04-16
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF.
399 CVE-2018-16365 352 CSRF 2018-09-02 2019-04-16
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF.
400 CVE-2018-16345 352 CSRF 2018-09-02 2018-11-13
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent.
Total number of vulnerabilities : 2521   Page : 1 2 3 4 5 6 7 8 (This Page)9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.