Total
7225 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-5329 | 1 Beims | 1 Contractorweb.net | 2018-02-05 | 6.8 MEDIUM | 8.8 HIGH |
| ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) on /CWEBNET/* authenticated pages. A successful CSRF attack can force the user to modify state: creating users, changing an email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application. | |||||
| CVE-2017-18033 | 1 Atlassian | 1 Jira | 2018-02-05 | 4.3 MEDIUM | 6.5 MEDIUM |
| The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abort an executing external system import via various Cross-site request forgery (CSRF) vulnerabilities. | |||||
| CVE-2018-5301 | 1 Magento | 1 Magento | 2018-02-02 | 5.8 MEDIUM | 6.5 MEDIUM |
| Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433. | |||||
| CVE-2017-16886 | 1 Fiberhome | 2 Lm53q1, Lm53q1 Firmware | 2018-02-02 | 6.8 MEDIUM | 8.8 HIGH |
| The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access to Web Services via CSRF can result in an unauthorized change of username or password of the administrator of the portal. | |||||
| CVE-2018-0785 | 1 Microsoft | 1 Asp.net Core | 2018-02-01 | 4.3 MEDIUM | 6.5 MEDIUM |
| ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request Forgery Vulnerability". | |||||
| CVE-2017-16862 | 1 Atlassian | 1 Jira | 2018-01-31 | 4.3 MEDIUM | 4.3 MEDIUM |
| The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery (CSRF) vulnerability. | |||||
| CVE-2012-0699 | 1 Haudenschilt | 1 Family Connections Cms | 2018-01-31 | 6.8 MEDIUM | 8.8 HIGH |
| Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php. | |||||
| CVE-2017-5264 | 1 Rapid7 | 1 Nexpose | 2018-01-31 | 6.8 MEDIUM | 8.8 HIGH |
| Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack. | |||||
| CVE-2017-16570 | 1 Keystonejs | 1 Keystone | 2018-01-31 | 6.8 MEDIUM | 8.8 HIGH |
| KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header. | |||||
| CVE-2016-0335 | 1 Ibm | 1 Security Identity Manager | 2018-01-29 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors. IBM X-Force ID: 111736. | |||||
| CVE-2018-5368 | 1 Srbtranslatin Project | 1 Srbtranslatin | 2018-01-29 | 6.8 MEDIUM | 8.8 HIGH |
| The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php. | |||||
| CVE-2018-5285 | 1 Wpscoop | 1 Imageinject | 2018-01-29 | 6.8 MEDIUM | 8.8 HIGH |
| The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php. | |||||
| CVE-2018-5658 | 1 Responsive Coming Soon Page Project | 1 Responsive Coming Soon Page | 2018-01-25 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php. | |||||
| CVE-2018-5656 | 1 Weblizar | 1 Pinterest-feeds | 2018-01-24 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php. | |||||
| CVE-2018-5669 | 1 Read And Understood Project | 1 Read And Understood | 2018-01-23 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php. | |||||
| CVE-2012-0317 | 1 Sixapart | 1 Movable Type | 2018-01-18 | 6.8 MEDIUM | N/A |
| Multiple cross-site request forgery (CSRF) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to hijack the authentication of arbitrary users for requests that modify data via the (1) commenting feature or (2) community script. | |||||
| CVE-2011-4140 | 1 Djangoproject | 1 Django | 2018-01-18 | 6.8 MEDIUM | N/A |
| The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code. | |||||
| CVE-2017-1000432 | 1 Vanillaforums | 1 Vanilla Forums | 2018-01-17 | 6.0 MEDIUM | 8.0 HIGH |
| Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access | |||||
| CVE-2018-5073 | 1 Advanced Real Estate Script Project | 1 Advanced Real Estate Script | 2018-01-17 | 6.0 MEDIUM | 6.8 MEDIUM |
| Online Ticket Booking has CSRF via admin/movieedit.php. | |||||
| CVE-2017-1672 | 1 Ibm | 1 Security Key Lifecycle Manager | 2018-01-16 | 6.8 MEDIUM | 8.8 HIGH |
| IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 133639. | |||||