CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CSRF)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
401 CVE-2018-16339 352 CSRF 2018-09-02 2018-10-25
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser.
402 CVE-2018-16338 352 CSRF 2018-09-02 2018-10-25
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic.
403 CVE-2018-16337 352 CSRF 2018-09-02 2018-10-25
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save.
404 CVE-2018-16332 352 CSRF 2018-09-01 2018-10-24
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability.
405 CVE-2018-16331 352 CSRF 2018-09-01 2018-10-23
6.8
None Remote Medium Not required Partial Partial Partial
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password.
406 CVE-2018-16315 352 CSRF 2018-09-01 2018-10-25
4.3
None Remote Medium Not required None Partial None
In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add.
407 CVE-2018-16314 352 Bypass CSRF 2018-09-01 2018-11-13
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRF_TOKEN, if CSRF_TOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header.
408 CVE-2018-16218 352 Exec Code CSRF 2019-05-29 2019-05-31
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF (Cross Site Request Forgery) in the web interface of the Yeahlink Ultra-elegant IP Phone SIP-T41P firmware version 66.83.0.35 allows a remote attacker to trigger code execution or settings modification on the device by providing a crafted link to the victim.
409 CVE-2018-16136 352 CSRF 2019-05-13 2019-05-16
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in the administrator interface in IPBRICK OS 6.3. The application doesn't check for Anti-CSRF tokens, allowing the submission of multiple forms unwillingly by a victim.
410 CVE-2018-15901 352 CSRF 2018-08-28 2018-11-02
6.8
None Remote Medium Not required Partial Partial Partial
e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators.
411 CVE-2018-15851 352 CSRF 2018-08-25 2018-10-17
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Flexo CMS v0.1.6. There is a CSRF vulnerability that can add an administrator via /admin/user/add.
412 CVE-2018-15850 352 CSRF 2018-08-25 2018-10-17
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user.
413 CVE-2018-15849 352 CSRF 2018-08-25 2018-10-17
4.3
None Remote Medium Not required None Partial None
An issue was discovered in portfolioCMS 1.0.5. There is CSRF to update the website settings via admin/aboutus.php.
414 CVE-2018-15848 352 CSRF 2018-08-25 2018-10-17
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in portfolioCMS 1.0.5. There is CSRF to create new pages via admin/portfolio.php?newpage=true.
415 CVE-2018-15846 352 CSRF 2018-08-25 2018-10-17
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in fledrCMS through 2014-02-03. There is a CSRF vulnerability that can change the administrator's password via index.php?p=done&savedata=1.
416 CVE-2018-15845 352 CSRF 2018-08-25 2018-10-17
6.8
None Remote Medium Not required Partial Partial Partial
There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add.
417 CVE-2018-15844 352 CSRF 2018-08-25 2018-10-17
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit.
418 CVE-2018-15702 352 CSRF 2018-10-01 2018-11-27
6.8
None Remote Medium Not required Partial Partial Partial
The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field.
419 CVE-2018-15682 352 CSRF 2018-09-05 2018-11-06
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to automate the action of sending private messages to users by luring an authenticated user to a web page that automatically submits a form on their behalf.
420 CVE-2018-15677 79 XSS CSRF 2018-09-05 2018-11-02
4.3
None Remote Medium Not required None Partial None
The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF.
421 CVE-2018-15612 352 CSRF 2018-09-21 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.
422 CVE-2018-15569 352 CSRF 2018-08-19 2018-10-12
4.3
None Remote Medium Not required None Partial None
my little forum 2.4.12 allows CSRF for deletion of users.
423 CVE-2018-15568 352 CSRF 2018-08-19 2018-11-01
6.8
None Remote Medium Not required Partial Partial Partial
tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html.
424 CVE-2018-15565 352 CSRF 2018-08-19 2018-10-12
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication for adding a page. This can also be exploited via CSRF.
425 CVE-2018-15564 352 CSRF 2018-08-19 2018-10-12
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8.
426 CVE-2018-15539 352 CSRF 2018-10-15 2018-11-30
6.8
None Remote Medium Not required Partial Partial Partial
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc.
427 CVE-2018-15445 352 CSRF 2018-11-08 2019-10-09
6.0
None Remote Medium Single system Partial Partial Partial
A vulnerability in the web-based management interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user.
428 CVE-2018-15438 352 CSRF 2018-10-17 2019-10-09
4.3
None Remote Medium Not required None Partial None
A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to use a web browser to perform arbitrary actions with the privileges of the user on an affected system.
429 CVE-2018-15402 352 +Priv CSRF 2018-10-17 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks. The vulnerability is due to improper validation of Origin headers on HTTP requests within the management interface. An attacker could exploit this vulnerability by convincing a targeted user to follow a URL to a malicious website. An exploit could allow the attacker to take actions within the software with the privileges of the targeted user or gain access to sensitive information.
430 CVE-2018-15401 352 CSRF 2018-10-05 2019-10-09
4.3
None Remote Medium Not required None Partial None
A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system via a web browser and with the privileges of the user.
431 CVE-2018-15365 79 XSS Bypass CSRF 2018-09-28 2018-11-16
3.5
None Remote Medium Single system None Partial None
A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability.
432 CVE-2018-15334 352 CSRF 2018-12-28 2019-01-04
4.3
None Remote Medium Not required None None Partial
A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to log out and require re-authentication.
433 CVE-2018-15206 352 CSRF 2019-04-30 2019-05-01
6.8
None Remote Medium Not required Partial Partial Partial
BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf.
434 CVE-2018-15203 352 CSRF 2018-08-08 2018-10-09
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/add_page allows a CSRF attack to add pages.
435 CVE-2018-15202 352 CSRF 2018-08-08 2018-10-18
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Juunan06 eCommerce through 2018-08-05. There is a CSRF vulnerability in ee/eBoutique/app/template/includes/crudTreatment.php that can add new users and add products.
436 CVE-2018-15198 352 CSRF 2018-08-07 2018-10-04
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user.
437 CVE-2018-15197 352 CSRF 2018-08-07 2018-10-04
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges.
438 CVE-2018-15193 352 CSRF 2018-08-07 2018-10-05
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link.
439 CVE-2018-15187 352 CSRF 2018-08-10 2018-10-05
6.0
None Remote Medium Single system Partial Partial Partial
PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php.
440 CVE-2018-15186 352 CSRF 2018-08-10 2018-10-09
6.8
None Remote Medium Not required Partial Partial Partial
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has CSRF via client/auditor/updprofile.php.
441 CVE-2018-15177 352 CSRF 2018-08-07 2018-10-05
6.8
None Remote Medium Not required Partial Partial Partial
In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account.
442 CVE-2018-15121 352 CSRF 2018-08-28 2018-11-08
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
443 CVE-2018-14978 352 CSRF 2018-08-06 2018-10-03
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI.
444 CVE-2018-14966 352 CSRF 2018-08-06 2018-10-04
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=user&do=add page allows CSRF.
445 CVE-2018-14965 352 CSRF 2018-08-06 2018-10-04
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF.
446 CVE-2018-14963 352 CSRF 2018-08-06 2018-10-04
6.8
None Remote Medium Not required Partial Partial Partial
zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI.
447 CVE-2018-14960 352 CSRF 2018-08-06 2018-10-04
6.8
None Remote Medium Not required Partial Partial Partial
Xiao5uCompany 1.7 has CSRF via admin/Admin.asp.
448 CVE-2018-14959 352 CSRF 2018-08-05 2018-10-04
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI.
449 CVE-2018-14958 352 CSRF 2018-08-05 2018-10-04
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings (such as the theme, title, and description) via index.php.
450 CVE-2018-14930 352 CSRF 2019-04-30 2019-05-03
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1. CSRF can occur via a /CollatWebApp/gcmsRefInsert?name=SUPP URI.
Total number of vulnerabilities : 2521   Page : 1 2 3 4 5 6 7 8 9 (This Page)10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.