Total
4240 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-17891 | 1 Readymade Video Sharing Script Project | 1 Readymade Video Sharing Script | 2018-01-09 | 6.8 MEDIUM | 8.8 HIGH |
| Readymade Video Sharing Script has CSRF via user-profile-edit.php. | |||||
| CVE-2017-17894 | 1 Basic Job Site Script Project | 1 Basic Job Site Script | 2018-01-09 | 6.8 MEDIUM | 8.8 HIGH |
| Readymade Job Site Script has CSRF via the /job URI. | |||||
| CVE-2017-17990 | 1 Iwcnetwork | 1 Biometric Shift Employee Management System | 2018-01-09 | 6.8 MEDIUM | 8.8 HIGH |
| Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action. | |||||
| CVE-2017-1631 | 1 Ibm | 1 Jazz For Service Management | 2018-01-05 | 6.8 MEDIUM | 8.8 HIGH |
| IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 133140. | |||||
| CVE-2017-1746 | 1 Ibm | 1 Jazz For Service Management | 2018-01-05 | 6.8 MEDIUM | 8.8 HIGH |
| IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 135519. | |||||
| CVE-2012-0235 | 1 Advantech | 1 Advantech Webaccess | 2018-01-04 | 6.0 MEDIUM | N/A |
| Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. | |||||
| CVE-2017-17774 | 1 Piwigo | 1 Piwigo | 2018-01-04 | 6.8 MEDIUM | 8.8 HIGH |
| admin/configuration.php in Piwigo 2.9.2 has CSRF. | |||||
| CVE-2017-17827 | 1 Piwigo | 1 Piwigo | 2018-01-03 | 6.8 MEDIUM | 8.8 HIGH |
| Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions. | |||||
| CVE-2017-17830 | 1 Doditsolutions | 1 Bus Booking Script | 2018-01-03 | 6.0 MEDIUM | 6.8 MEDIUM |
| Bus Booking Script has CSRF via admin/new_master.php. | |||||
| CVE-2014-0831 | 1 Ibm | 1 Financial Transaction Manager | 2018-01-02 | 6.8 MEDIUM | N/A |
| Cross-site request forgery (CSRF) vulnerability in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that modify configuration data. | |||||
| CVE-2012-1985 | 1 Realnetworks | 2 Helix Mobile Server, Helix Server | 2017-12-28 | 6.8 MEDIUM | N/A |
| Cross-site request forgery (CSRF) vulnerability in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to hijack the authentication of administrators for requests that cause a denial of service (stack consumption and daemon crash) via a malformed URL. | |||||
| CVE-2012-2341 | 2 Drupal, Rahul Singla | 2 Drupal, Take Control | 2017-12-28 | 6.8 MEDIUM | N/A |
| Cross-site request forgery (CSRF) vulnerability in the Take Control module 6.x-2.x before 6.x-2.2 for Drupal allows remote attackers to hijack the authentication of unspecified users for Ajax requests that manipulate files. | |||||
| CVE-2017-14092 | 1 Trendmicro | 1 Scanmail | 2017-12-26 | 6.8 MEDIUM | 8.8 HIGH |
| The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain. | |||||
| CVE-2017-17056 | 1 Zkteco | 1 Zktime Web | 2017-12-20 | 6.8 MEDIUM | 8.8 HIGH |
| The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'password_change()' function of the Modify Password component, reachable via the old_password, new_password1, and new_password2 parameters to the /accounts/password_change/ URI. An attacker takes advantage of this scenario and creates a crafted CSRF link to add himself as an administrator to the ZKTime Web Software. He then uses social engineering methods to trick the administrator into clicking the forged HTTP request. The request is executed and the attacker becomes the Administrator of the ZKTime Web Software. If the vulnerability is successfully exploited, then an attacker (who would be a normal user of the web application) can escalate his privileges and become the administrator of ZKTime Web Software. | |||||
| CVE-2016-10701 | 1 Hitachivantara | 1 Pentaho Business Analytics | 2017-12-16 | 6.8 MEDIUM | 8.8 HIGH |
| In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application. | |||||
| CVE-2012-1936 | 1 Wordpress | 1 Wordpress | 2017-12-13 | 6.8 MEDIUM | N/A |
| ** DISPUTED ** The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wp_create_nonce operates as intended, even if it is arguably inconsistent with certain CSRF protection details advocated by external organizations. | |||||
| CVE-2012-2397 | 1 Owncloud | 1 Owncloud | 2017-12-12 | 6.8 MEDIUM | N/A |
| Cross-site request forgery (CSRF) vulnerability in ownCloud before 3.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences via vectors involving contacts. | |||||
| CVE-2017-8138 | 1 Huawei | 1 Hedex Lite | 2017-12-08 | 6.8 MEDIUM | 8.8 HIGH |
| HedEx Earlier than V200R006C00 versions has a cross-site request forgery (CSRF) vulnerability. An attacker could trick a user into accessing a website containing malicious scripts which may tamper with configurations and interrupt normal services. | |||||
| CVE-2017-1000224 | 1 Embedplus | 1 Youtube | 2017-12-03 | 4.3 MEDIUM | 6.5 MEDIUM |
| CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin | |||||
| CVE-2017-7851 | 1 D-link | 1 Dcs-936l | 2017-12-03 | 6.8 MEDIUM | 8.8 HIGH |
| D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header. | |||||