Security Vulnerabilities Published In 2007(CSRF)

2007 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2007-6490	352	CSRF	2007-12-20	2017-09-29	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in Falcon Series One CMS 1.4.3 allows remote attackers to change a password via a certain changepass action to index.php.
2	CVE-2007-6410	352	DoS CSRF	2007-12-17	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Gadu-Gadu does not properly perform protocol handling, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and add arbitrary user accounts or cause a denial of service as administrators via an unspecified "crafted link," possibly related to the gg protocol.
3	CVE-2007-6390	352	XSS CSRF	2007-12-17	2008-09-05	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform actions as blog administrators, which can be leveraged to conduct cross-site scripting (XSS) attacks on the blog page.
4	CVE-2007-6320	352	CSRF	2007-12-12	2008-11-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Feature 4.7.x-dev and 5.x-dev before 20071206, a Drupal module, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks.
5	CVE-2007-6300	352	CSRF	2007-12-10	2008-11-15	5.0	None	Remote	Low	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in Fusion News 3.9.0 allows remote attackers to perform unauthorized actions via unspecified vectors.
6	CVE-2007-6087	352	CSRF	2007-11-22	2018-10-15	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in index.php in VigileCMS 1.4 allows remote attackers to change the admin password via certain parameters to the changepass module.
7	CVE-2007-5960	22	Dir. Trav. Bypass CSRF	2007-11-26	2023-02-13	4.3	None	Remote	Medium	Not required	None	Partial	None
Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent.
8	CVE-2007-5918	352	CSRF	2007-11-10	2018-10-15	6.0	None	Remote	Medium	???	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an arbitrary user via a modified uname value in an edit action to modules.php.
9	CVE-2007-5917	352	CSRF	2007-11-10	2018-10-15	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in admin/admin_account.php in Skalinks 1.5 and earlier allows remote attackers to add arbitrary privileged accounts as administrators via the admin_name, admin_password, admin_type, and Add_admin parameters.
10	CVE-2007-5828	352	CSRF	2007-11-05	2018-10-15	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
DISPUTED Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module.
11	CVE-2007-5818	352	CSRF	2007-11-05	2018-10-15	7.6	None	Remote	High	Not required	Complete	Complete	Complete
Cross-site request forgery (CSRF) vulnerability in blocks_edit_do.php in sBlog 0.7.3 Beta allows remote attackers to change arbitrary blocks as administrators.
12	CVE-2007-5799	352	CSRF	2007-11-03	2017-07-29	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site request forgery (CSRF) vulnerabilities in uddigui/navigateTree.do in the UDDI user console in IBM WebSphere Application Server (WAS) before 6.1.0 Fix Pack 13 (6.1.0.13) allow remote attackers to perform some actions as WAS UDDI users via the (1) keyField, (2) nameField, (3) valueField, and (4) frameReturn parameters.
13	CVE-2007-5773	352	CSRF	2007-11-01	2017-09-29	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in index.php in the File Manager module in Flatnuke 3 allows remote attackers to perform certain actions as administrators via requests containing the pathname in the dir parameter and the filename in the ffile parameter.
14	CVE-2007-5594	352	CSRF	2007-10-19	2021-04-19	4.3	None	Remote	Medium	Not required	None	Partial	None
Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery (CSRF) attack.
15	CVE-2007-5575	352	CSRF	2007-10-18	2017-07-29	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in 1024 CMS 1.2.5 allows remote attackers to perform some actions as administrators, as demonstrated by (1) an unspecified action that creates a file containing PHP code and (2) unspecified use of the forum component. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
16	CVE-2007-5572	352	CSRF	2007-10-18	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Blog (SPHPBlog) 0.4.9 allow remote attackers to perform delete actions as administrators via (1) the block_id parameter to add_block.php or (2) the link_id parameter to add_link.php.
17	CVE-2007-5384	352	Bypass CSRF	2007-10-12	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site request forgery (CSRF) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistance HTTPS session on TCP port 51003. NOTE: an authentication bypass can be leveraged to exploit this in the absence of an existing administrative session. NOTE: SpeedTouch 780 might also be affected by some of these issues.
18	CVE-2007-5383	287	Bypass CSRF	2007-10-12	2018-10-15	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allows remote attackers on an intranet to bypass authentication and gain administrative access via vectors including a '/' (slash) character at the end of the PATH_INFO to cgi/b, aka "double-slash auth bypass." NOTE: remote attackers outside the intranet can exploit this by leveraging a separate CSRF vulnerability. NOTE: SpeedTouch 780 might also be affected by some of these issues.
19	CVE-2007-5259	352	CSRF	2007-10-06	2008-11-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in Ilient SysAid 4.5.03 and 4.5.04 allows remote attackers to perform some actions as administrators, as demonstrated by changing the administrator password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
20	CVE-2007-5229	352	CSRF	2007-10-05	2017-10-05	6.4	None	Remote	Low	Not required	Partial	Partial	None
Cross-site request forgery (CSRF) vulnerability in the FeedBurner FeedSmith 2.2 plugin for WordPress allows remote attackers to change settings and hijack blog feeds via a request to wp-admin/options-general.php that submits parameter values to FeedBurner_FeedSmith_Plugin.php, as demonstrated by the (1) feedburner_url and (2) feedburner_comments_url parameters.
21	CVE-2007-5214	79	XSS CSRF	2007-10-04	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to the default URI associated with a directory, as demonstrated by (a) the root directory and (b) the view/ directory; (2) parameters associated with saved settings, as demonstrated by (c) the conf_Network_HostName parameter on the Network page and (d) the conf_Layout_OwnTitle parameter to ServerManager.srv; and (3) the query string to ServerManager.srv, which is displayed on the logs page. NOTE: an attacker can leverage a CSRF vulnerability to modify saved settings.
22	CVE-2007-5213	352	CSRF	2007-10-04	2018-10-15	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Multiple cross-site request forgery (CSRF) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to perform actions as administrators, as demonstrated by (1) an SMTP server change through the conf_SMTP_MailServer1 parameter to ServerManager.srv and (2) a hostname change through the conf_Network_HostName parameter on the Network page.
23	CVE-2007-5212	79	XSS CSRF	2007-10-04	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware before 2.43 allow remote attackers to inject arbitrary web script or HTML via (1) parameters associated with saved settings, as demonstrated by the conf_SMTP_MailServer1 parameter to ServerManager.srv; or (2) the subpage parameter to wizard/first/wizard_main_first.shtml. NOTE: an attacker can leverage a CSRF vulnerability to modify saved settings.
24	CVE-2007-5109	352	CSRF	2007-09-26	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in index.php in FlatNuke 2.6, and possibly 3, allows remote attackers to change the password and privilege level of arbitrary accounts via the user parameter and modified (1) regpass and (2) level parameters in a none_Login action, as demonstrated by using a Flash object to automatically make the request.
25	CVE-2007-5060	352	CSRF	2007-09-24	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in the cpass functionality in an admin action in index.php in XCMS allows remote attackers to change arbitrary passwords via certain password_ and rpassword_ parameters, possibly related to timestamp values.
26	CVE-2007-5032	352	CSRF	2007-09-21	2018-10-15	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in admin.php in Francisco Burzi PHP-Nuke allows remote attackers to add administrative accounts via an AddAuthor action with modified add_name and add_radminsuper parameters.
27	CVE-2007-4930	352	CSRF	2007-09-18	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site request forgery (CSRF) vulnerabilities in the AXIS 207W camera allow remote attackers to perform certain actions as administrators via (1) axis-cgi/admin/restart.cgi, (2) the user and sgrp parameters to axis-cgi/admin/pwdgrp.cgi in an add action, or (3) the server parameter to admin/restartMessage.shtml.
28	CVE-2007-4822	352	CSRF	2007-09-11	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuration changes as an administrator via HTTP requests to certain HTML pages in the res parameter with an inp req parameter to cgi-bin/cgi, as demonstrated by accessing (1) ap.html and (2) filter_ip.html.
29	CVE-2007-4724	352	CSRF	2007-09-05	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters.
30	CVE-2007-4389		CSRF	2007-08-17	2018-10-15	7.8	None	Remote	Medium	Not required	None	Partial	Complete
Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG, 1800HW, and 2071 Gateway routers, with 3.17.5, 3.7.1, and 5.29.51 software, allows remote attackers to create DNS mappings as administrators, and conduct DNS poisoning attacks, via the NAME and ADDR parameters.
31	CVE-2007-4387		CSRF	2007-08-17	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG and 2071 Gateway routers, with 3.17.5 and 5.29.51 software, allows remote attackers to perform certain configuration changes as administrators.
32	CVE-2007-4319		DoS CSRF	2007-08-13	2018-10-15	4.0	None	Remote	Low	???	None	None	Partial
The management interface in ZyNOS firmware 3.62(WK.6) on the Zyxel Zywall 2 device allows remote authenticated administrators to cause a denial of service (infinite reboot loop) via invalid configuration data. NOTE: this issue might not cross privilege boundaries, and it might be resultant from CSRF; if so, then it should not be included in CVE.
33	CVE-2007-4317		CSRF	2007-08-13	2018-10-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface in ZyNOS firmware 3.62(WK.6) on the Zyxel Zywall 2 device allow remote attackers to perform certain actions as administrators, as demonstrated by a request to Forms/General_1 with the (1) sysSystemName and (2) sysDomainName parameters.
34	CVE-2007-4193		CSRF	2007-08-08	2017-07-29	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in IDE Group DVD Rental System (DRS) 5.1 before 20070801 allow remote attackers to perform certain actions as arbitrary users, as demonstrated by (1) modifying data or (2) canceling a subscription. NOTE: it is not clear whether IDE Group updates all DRS installations in its role as an application service provider. If so, then this issue should not be included in CVE.
35	CVE-2007-4063		CSRF	2007-07-30	2017-07-29	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.2 allow remote attackers to (1) delete comments, (2) delete content revisions, and (3) disable menu items as privileged users, related to improper use of HTTP GET and the Forms API.
36	CVE-2007-4017		CSRF	2007-07-26	2017-07-29	7.6	None	Remote	High	Not required	Complete	Complete	Complete
Cross-site request forgery (CSRF) vulnerability in the web-based administration console in Citrix Access Gateway before firmware 4.5.5 allows remote attackers to perform certain configuration changes as administrators.
37	CVE-2007-3821		CSRF	2007-07-17	2018-10-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in Webcit before 7.11 allows remote attackers to modify configurations and perform other actions as arbitrary users via unspecified vectors.
38	CVE-2007-3787		+Priv CSRF	2007-07-15	2018-10-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The eSoft InstaGate EX2 UTM device does not require entry of the old password when changing the admin password, which might allow remote attackers to gain privileges by conducting a CSRF attack, making a password change from an unattended workstation, or other attacks.
39	CVE-2007-3786		CSRF	2007-07-15	2018-10-15	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
DISPUTED Cross-site request forgery (CSRF) vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a former customer.
40	CVE-2007-3773	94	CSRF	2007-07-15	2018-10-15	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Cross-site request forgery (CSRF) vulnerability in the Email-Template module in Generic YouTube Clone Script allows remote attackers to upload files with arbitrary file types to templates/emails/ as administrators.
41	CVE-2007-3688		CSRF	2007-07-11	2017-07-29	2.6	None	Remote	High	Not required	None	Partial	None
Multiple cross-site request forgery (CSRF) vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the (1) tool_url parameter to ecrire/tools.php and multiple fields on the (2) blogconf, (3) blogroll, (4) ecrire/redacteur.php, and (5) ecrire/user_prefs.php pages.
42	CVE-2007-3489		CSRF	2007-06-29	2018-10-16	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Cross-site request forgery (CSRF) vulnerability in pop/WizU.html in the management interface in Check Point VPN-1 Edge X Embedded NGX 7.0.33x on the Check Point VPN-1 UTM Edge allows remote attackers to perform privileged actions as administrators, as demonstrated by a request with the swuuser and swupass parameters, which adds an administrator account. NOTE: the CSRF attack has no timing window because there is no logout capability in the management interface.
43	CVE-2007-3464		+Priv CSRF	2007-06-27	2018-10-16	8.5	None	Remote	Medium	???	Complete	Complete	Complete
Check Point SofaWare [email protected], with firmware before Embedded NGX 7.0.45 GA, does not require entry of the old password when changing the admin password, which might allow attackers to gain privileges by conducting a CSRF attack, making a password change on an unattended workstation, or other vectors.
44	CVE-2007-3462		Exec Code CSRF	2007-06-27	2018-10-16	6.0	None	Remote	Medium	???	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in Check Point SofaWare [email protected], with firmware before Embedded NGX 7.0.45 GA, allows remote attackers to execute commands as arbitrary users, and disable firewalling of the protected network.
45	CVE-2007-3457	352	CSRF	2007-07-11	2017-07-29	4.3	None	Remote	Medium	Not required	None	Partial	None
Adobe Flash Player 8.0.34.0 and earlier insufficiently validates HTTP Referer headers, which might allow remote attackers to conduct a CSRF attack via a crafted SWF file.
46	CVE-2007-3416	352	CSRF	2007-06-26	2017-07-29	5.0	None	Remote	Low	Not required	None	Partial	None
Multiple cross-site request forgery (CSRF) vulnerabilities in the administration of (1) polls, (2) profiles, (3) IP bans, and (4) forums in (a) web-app.org WebAPP 0.8 through 0.9.9.6; and (b) web-app.net WebAPP 0.9.9.3.3, 0.9.9.3.4, and 2007; allow remote attackers to perform deletions as administrators.
47	CVE-2007-3331		CSRF	2007-06-21	2017-07-29	5.0	None	Remote	Low	Not required	None	Partial	None
Cross-site request forgery (CSRF) vulnerability in STphp EasyNews PRO 4.0 allows remote attackers to change the admin password via (1) a certain HTML form that is posted automatically by JavaScript or (2) a news post.
48	CVE-2007-3255		Exec Code CSRF	2007-06-27	2018-10-16	6.5	None	Remote	Low	???	Partial	Partial	Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to execute commands as arbitrary users via (1) a saved Workflow name or (2) the Content-Type HTTP header. NOTE: item 2 also affects the same version numbers of Xythos Digital Locker (XDL). One or both vectors might also affect Xythos WebFile Server.
49	CVE-2007-2828		CSRF	2007-05-22	2017-07-29	6.0	None	Remote	Medium	???	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for WordPress allows remote attackers to perform unspecified actions as arbitrary users via unspecified vectors.
50	CVE-2007-2631		CSRF	2007-05-13	2018-10-16	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in SquirrelMail 1.4.8-4.fc6 and earlier allows remote attackers to perform unspecified actions as arbitrary users via unspecified vectors. NOTE: this issue might overlap CVE-2007-2589 or CVE-2002-1648.

Total number of vulnerabilities : 69 Page : 1 (This Page)2