CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2021(CSRF)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-34547 CSRF 2021-06-10 2021-06-10
0.0
None ??? ??? ??? ??? ??? ???
PRTG Network Monitor 20.1.55.1775 allows /editsettings CSRF for user account creation.
2 CVE-2021-32677 CSRF 2021-06-09 2021-06-09
0.0
None ??? ??? ??? ??? ??? ???
FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. This is fixed in FastAPI 0.65.2. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.
3 CVE-2021-32632 352 CSRF 2021-05-20 2021-05-27
4.3
None Remote Medium Not required None Partial None
Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery (CSRF). Hosters of the bot should upgrade to `v1.52` or `stable` to install the patch or, as a workaround, can add one modern dependency.
4 CVE-2021-32403 352 CSRF 2021-05-17 2021-06-09
6.8
None Remote Medium Not required Partial Partial Partial
Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mechanisms for token protection and unsafe inputs and modules.
5 CVE-2021-32402 352 CSRF 2021-05-17 2021-05-25
6.8
None Remote Medium Not required Partial Partial Partial
Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurations in inputs and modules.
6 CVE-2021-32096 352 CSRF 2021-05-07 2021-05-19
6.8
None Remote Medium Not required Partial Partial Partial
The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLE_COMMAND_STRING parameter.
7 CVE-2021-32073 352 Exec Code CSRF 2021-05-15 2021-05-21
6.8
None Remote Medium Not required Partial Partial Partial
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
8 CVE-2021-31762 352 CSRF 2021-04-25 2021-04-28
6.8
None Remote Medium Not required Partial Partial Partial
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell through Webmin's running process feature.
9 CVE-2021-31760 352 Exec Code CSRF 2021-04-25 2021-04-28
6.8
None Remote Medium Not required Partial Partial Partial
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature.
10 CVE-2021-31659 CSRF 2021-06-10 2021-06-10
0.0
None ??? ??? ??? ??? ??? ???
TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is vulnerable to Cross Site Request Forgery (CSRF). All configuration information is placed in the URL, without any additional token authentication information. A malicious link opened by the switch administrator may cause the password of the switch to be modified and the configuration file to be tampered with.
11 CVE-2021-31584 352 CSRF 2021-04-23 2021-05-14
6.8
None Remote Medium Not required Partial Partial Partial
Sipwise C5 NGCP www_admin version 3.6.7 allows call/click2dial CSRF attacks for actions with administrative privileges.
12 CVE-2021-31408 613 CSRF 2021-04-23 2021-05-04
3.3
None Local Medium Not required Partial Partial None
Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.
13 CVE-2021-31406 203 CSRF 2021-04-23 2021-04-30
1.9
None Local Medium Not required Partial None None
Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.
14 CVE-2021-31404 203 CSRF 2021-04-23 2021-04-30
1.9
None Local Medium Not required Partial None None
Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.
15 CVE-2021-31403 203 CSRF 2021-04-23 2021-04-30
1.9
None Local Medium Not required Partial None None
Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack
16 CVE-2021-31152 352 CSRF 2021-04-14 2021-04-21
6.8
None Remote Medium Not required Partial Partial Partial
Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can enable remote access, change passwords, and perform other actions through misconfigured requests, entries, and headers.
17 CVE-2021-30224 352 CSRF 2021-04-29 2021-05-03
6.8
None Remote Medium Not required Partial Partial Partial
Cross Site Request Forgery (CSRF) in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials.
18 CVE-2021-30147 352 CSRF 2021-04-07 2021-04-12
6.8
None Remote Medium Not required Partial Partial Partial
DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php.
19 CVE-2021-30114 352 CSRF 2021-04-08 2021-04-13
4.3
None Remote Medium Not required None Partial None
Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a voucher payment request through module/accounting/voucher/create. The application fails to validate the CSRF token for a POST request using admin privilege.
20 CVE-2021-30112 352 CSRF 2021-04-08 2021-04-13
4.3
None Remote Medium Not required None Partial None
Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a student_leave_application request through module/core/studentleaveapplication/create. The application fails to validate the CSRF token for a POST request using Guardian privilege.
21 CVE-2021-29995 CSRF 2021-06-09 2021-06-09
0.0
None ??? ??? ??? ??? ??? ???
A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX through 5.9.0 allows remote attackers to execute any action as the logged-in user (including script execution). The issue is resolved in CloverDX 5.10, CloverDX 5.9.1, CloverDX 5.8.2, and CloverDX 5.7.1.
22 CVE-2021-29660 352 CSRF 2021-04-02 2021-04-08
6.8
None Remote Medium Not required Partial Partial Partial
A Cross-Site Request Forgery (CSRF) vulnerability in en/cfg_setpwd.html in Softing AG OPC Toolbox through 4.10.1.13035 allows attackers to reset the administrative password by inducing the Administrator user to browse a URL controlled by an attacker.
23 CVE-2021-29624 565 CSRF 2021-05-19 2021-05-26
4.3
None Remote Medium Not required None Partial None
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.
24 CVE-2021-29436 352 Exec Code CSRF 2021-04-13 2021-04-26
5.8
None Remote Medium Not required Partial Partial None
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed().
25 CVE-2021-29435 352 Bypass CSRF 2021-04-13 2021-04-19
4.3
None Remote Medium Not required None Partial None
trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials. The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.
26 CVE-2021-29349 352 CSRF 2021-03-31 2021-04-07
4.3
None Remote Medium Not required None Partial None
Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieform_delete_all_notifications request, which leads to removing all messages from a mailbox.
27 CVE-2021-29238 352 CSRF 2021-05-03 2021-05-11
6.8
None Remote Medium Not required Partial Partial Partial
CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF).
28 CVE-2021-29054 352 +Priv CSRF 2021-04-13 2021-04-21
6.8
None Remote Medium Not required Partial Partial Partial
Certain Papoo products are affected by: Cross Site Request Forgery (CSRF) in the admin interface. This affects Papoo CMS Light through 21.02 and Papoo CMS Pro through 6.0.1. The impact is: gain privileges (remote).
29 CVE-2021-28280 XSS CSRF 2021-04-29 2021-04-29
0.0
None ??? ??? ??? ??? ??? ???
CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
30 CVE-2021-28055 CSRF 2021-04-15 2021-04-15
0.0
None ??? ??? ??? ??? ??? ???
An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user.
31 CVE-2021-27927 352 CSRF 2021-03-03 2021-03-29
6.8
None Remote Medium Not required Partial Partial Partial
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
32 CVE-2021-27181 352 CSRF 2021-04-14 2021-04-21
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the value of the anti-CSRF token, the attacker may trick the user into visiting his malicious page and performing any request with the privileges of attacked user.
33 CVE-2021-26961 352 +Priv CSRF 2021-03-05 2021-03-11
6.8
None Remote Medium Not required Partial Partial Partial
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user.
34 CVE-2021-26960 352 +Priv CSRF 2021-03-05 2021-03-11
6.8
None Remote Medium Not required Partial Partial Partial
A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user.
35 CVE-2021-26296 352 CSRF 2021-02-19 2021-06-02
5.1
None Remote High Not required Partial Partial Partial
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
36 CVE-2021-26216 352 CSRF 2021-03-18 2021-03-22
4.3
None Remote Medium Not required None Partial None
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.
37 CVE-2021-26215 352 CSRF 2021-03-18 2021-03-22
4.3
None Remote Medium Not required None Partial None
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.
38 CVE-2021-26071 352 CSRF 2021-04-01 2021-04-05
3.5
None Remote Medium ??? None Partial None
The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability.
39 CVE-2021-26034 352 CSRF 2021-05-26 2021-05-28
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sysinfo.
40 CVE-2021-26033 352 CSRF 2021-05-26 2021-05-28
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint.
41 CVE-2021-25931 352 CSRF 2021-05-20 2021-05-26
6.8
None Remote Medium Not required Partial Partial Partial
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at `/opennms/admin/userGroupView/users/updateUser`. This flaw allows assigning `ROLE_ADMIN` security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a normal user by enticing him to click upon an attacker-controlled website.
42 CVE-2021-25930 352 CSRF 2021-05-20 2021-05-26
4.3
None Remote Medium Not required None Partial None
In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.
43 CVE-2021-25924 352 Exec Code CSRF 2021-04-01 2021-04-06
9.3
None Remote Medium Not required Complete Complete Complete
In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the post_backup_script field.
44 CVE-2021-25765 352 CSRF 2021-02-03 2021-02-04
6.8
None Remote Medium Not required Partial Partial Partial
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
45 CVE-2021-25327 352 XSS CSRF 2021-04-09 2021-06-04
4.3
None Remote Medium Not required None Partial None
Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery (CSRF) vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp. Missing CSRF protection in devices can lead to XSRF, as the above pages are vulnerable to cross-site scripting (XSS).
46 CVE-2021-24333 352 XSS CSRF 2021-06-01 2021-06-11
4.3
None Remote Medium Not required None Partial None
The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.
47 CVE-2021-24328 352 XSS CSRF 2021-06-01 2021-06-11
3.5
None Remote Medium ??? None Partial None
The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well
48 CVE-2021-24324 352 XSS CSRF 2021-05-17 2021-05-24
4.3
None Remote Medium Not required None Partial None
The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user change the plugin's settings. Due to the lack of sanitisation and escaping in some fields, it could also lead to Stored Cross-Site Scripting issues
49 CVE-2021-24301 79 XSS CSRF 2021-05-24 2021-05-28
3.5
None Remote Medium ??? None Partial None
The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users.
50 CVE-2021-24272 352 XSS CSRF 2021-05-05 2021-05-10
4.3
None Remote Medium Not required None Partial None
The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue
Total number of vulnerabilities : 176   Page : 1 (This Page)2 3 4
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.