Total
4240 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2012-6297 | 1 Dd-wrt | 1 Dd-wrt | 2020-02-11 | 9.3 HIGH | 8.8 HIGH |
| Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could let a remote malicious user cause a Denial of Service. | |||||
| CVE-2019-19667 | 1 Maxum | 1 Rumpus Ftp | 2020-02-11 | 5.8 MEDIUM | 5.4 MEDIUM |
| A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an attacker to whitelist or block any IP address via RAPR/BlockedClients.html. | |||||
| CVE-2019-19666 | 1 Maxum | 1 Rumpus Ftp | 2020-02-11 | 4.3 MEDIUM | 4.3 MEDIUM |
| A CSRF vulnerability exists in the Event Notices Settings of Web File Manager in Rumpus FTP 8.2.9.1. An attacker can create/update event notices via RAPR/EventNoticesSet.html. | |||||
| CVE-2019-19669 | 1 Maxum | 1 Rumpus Ftp | 2020-02-11 | 5.8 MEDIUM | 6.5 MEDIUM |
| A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1. This could allow an attacker to delete, create, and update the upload forms via RAPR/TriggerServerFunction.html. | |||||
| CVE-2014-5288 | 1 Kemptechnologies | 1 Load Master | 2020-02-11 | 6.8 MEDIUM | 8.8 HIGH |
| A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages. | |||||
| CVE-2019-19668 | 1 Maxum | 1 Rumpus Ftp | 2020-02-11 | 4.3 MEDIUM | 4.3 MEDIUM |
| A CSRF vulnerability exists in the File Types component of Web File Manager in Rumpus FTP 8.2.9.1 that allows an attacker to add or delete the file types that are used on the server via RAPR/TriggerServerFunction.html. | |||||
| CVE-2019-19659 | 1 Maxum | 1 Rumpus | 2020-02-11 | 6.8 MEDIUM | 8.8 HIGH |
| A CSRF vulnerability exists in the Web File Manager's Edit Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can take over a user account by changing the password, update users' details, and escalate privileges via RAPR/DefineUsersSet.html. | |||||
| CVE-2019-19660 | 1 Maxum | 1 Rumpus | 2020-02-11 | 4.3 MEDIUM | 6.5 MEDIUM |
| A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate the SMTP setting and other network settings via RAPR/NetworkSettingsSet.html. | |||||
| CVE-2019-19665 | 1 Maxum | 1 Rumpus | 2020-02-11 | 4.3 MEDIUM | 6.5 MEDIUM |
| A CSRF vulnerability exists in the FTP Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server FTP settings at RAPR/FTPSettingsSet.html. | |||||
| CVE-2019-20059 | 1 Mfscripts | 1 Yetishare | 2020-02-10 | 6.8 MEDIUM | 8.8 HIGH |
| payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0 parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection. NOTE: this issue exists because of an incomplete fix for CVE-2019-19732. | |||||
| CVE-2013-3366 | 1 Trendnet | 2 Tew-812dru, Tew-812dru Firmware | 2020-02-10 | 9.3 HIGH | 8.8 HIGH |
| Undocumented TELNET service in TRENDnet TEW-812DRU when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg_24Mhw3. | |||||
| CVE-2008-6586 | 1 Utorrent | 1 Utorrent Webui | 2020-02-10 | 6.8 MEDIUM | N/A |
| Cross-site request forgery (CSRF) vulnerability in gui/index.php in µTorrent (uTorrent) WebUI 0.315 allows remote attackers to (1) hijack the authentication of users for requests that force the download of arbitrary torrent files via the add-url action and (2) hijack the authentication of administrators for requests that modify the administrator account via the setsetting action. | |||||
| CVE-2019-19663 | 1 Maxum | 1 Rumpus | 2020-02-10 | 5.8 MEDIUM | 6.5 MEDIUM |
| A CSRF vulnerability exists in the Folder Sets Settings of Web File Manager in Rumpus FTP 8.2.9.1. This allows an attacker to Create/Delete Folders after exploiting it at RAPR/FolderSetsSet.html. | |||||
| CVE-2011-1085 | 1 Smoothwall | 1 Smoothwall Express | 2020-02-10 | 6.8 MEDIUM | 8.8 HIGH |
| CSRF vulnerability in Smoothwall Express 3. | |||||
| CVE-2020-8658 | 1 Bestwebsoft | 1 Htaccess | 2020-02-07 | 6.8 MEDIUM | 8.8 HIGH |
| The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website. | |||||
| CVE-2020-8425 | 1 Cups Easy \(purchase \& Inventory\) Project | 1 Cups Easy \(purchase \& Inventory\) | 2020-02-07 | 4.3 MEDIUM | 6.5 MEDIUM |
| Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php. | |||||
| CVE-2011-0525 | 1 Batavi | 1 Batavi | 2020-02-07 | 6.8 MEDIUM | 8.8 HIGH |
| Batavi before 1.0 has CSRF. | |||||
| CVE-2020-8420 | 1 Joomla | 1 Joomla\! | 2020-02-07 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability. | |||||
| CVE-2020-8419 | 1 Joomla | 1 Joomla\! | 2020-02-06 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities. | |||||
| CVE-2020-8417 | 1 Codesnippets | 1 Code Snippets | 2020-02-06 | 6.8 MEDIUM | 8.8 HIGH |
| The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu. | |||||