Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2011-0535

Summary
Assigner-redhat
Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749
Published At-08 Feb, 2011 | 21:00
Updated At-06 Aug, 2024 | 21:58
Rejected At-
Credits

Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:redhat
Assigner Org ID:53f830b8-0a3f-465b-8143-3b8a9948e749
Published At:08 Feb, 2011 | 21:00
Updated At:06 Aug, 2024 | 21:58
Rejected At:
▼CVE Numbering Authority (CNA)

Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.

Affected Products
Vendor
n/a
Product
n/a
Versions
Affected
  • n/a
Problem Types
TypeCWE IDDescription
textN/An/a
Type: text
CWE ID: N/A
Description: n/a
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
http://openwall.com/lists/oss-security/2011/02/03/1
mailing-list
x_refsource_MLIST
http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
x_refsource_CONFIRM
http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
x_refsource_CONFIRM
http://www.osvdb.org/70751
vdb-entry
x_refsource_OSVDB
http://secunia.com/advisories/43114
third-party-advisory
x_refsource_SECUNIA
http://securityreason.com/securityalert/8067
third-party-advisory
x_refsource_SREASON
http://openwall.com/lists/oss-security/2011/02/01/1
mailing-list
x_refsource_MLIST
http://seclists.org/fulldisclosure/2011/Feb/0
mailing-list
x_refsource_FULLDISC
http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html
x_refsource_MISC
Hyperlink: http://openwall.com/lists/oss-security/2011/02/03/1
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
Resource:
x_refsource_CONFIRM
Hyperlink: http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
Resource:
x_refsource_CONFIRM
Hyperlink: http://www.osvdb.org/70751
Resource:
vdb-entry
x_refsource_OSVDB
Hyperlink: http://secunia.com/advisories/43114
Resource:
third-party-advisory
x_refsource_SECUNIA
Hyperlink: http://securityreason.com/securityalert/8067
Resource:
third-party-advisory
x_refsource_SREASON
Hyperlink: http://openwall.com/lists/oss-security/2011/02/01/1
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://seclists.org/fulldisclosure/2011/Feb/0
Resource:
mailing-list
x_refsource_FULLDISC
Hyperlink: http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
http://openwall.com/lists/oss-security/2011/02/03/1
mailing-list
x_refsource_MLIST
x_transferred
http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
x_refsource_CONFIRM
x_transferred
http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
x_refsource_CONFIRM
x_transferred
http://www.osvdb.org/70751
vdb-entry
x_refsource_OSVDB
x_transferred
http://secunia.com/advisories/43114
third-party-advisory
x_refsource_SECUNIA
x_transferred
http://securityreason.com/securityalert/8067
third-party-advisory
x_refsource_SREASON
x_transferred
http://openwall.com/lists/oss-security/2011/02/01/1
mailing-list
x_refsource_MLIST
x_transferred
http://seclists.org/fulldisclosure/2011/Feb/0
mailing-list
x_refsource_FULLDISC
x_transferred
http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html
x_refsource_MISC
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/02/03/1
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: http://www.osvdb.org/70751
Resource:
vdb-entry
x_refsource_OSVDB
x_transferred
Hyperlink: http://secunia.com/advisories/43114
Resource:
third-party-advisory
x_refsource_SECUNIA
x_transferred
Hyperlink: http://securityreason.com/securityalert/8067
Resource:
third-party-advisory
x_refsource_SREASON
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/02/01/1
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://seclists.org/fulldisclosure/2011/Feb/0
Resource:
mailing-list
x_refsource_FULLDISC
x_transferred
Hyperlink: http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html
Resource:
x_refsource_MISC
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:secalert@redhat.com
Published At:08 Feb, 2011 | 22:00
Updated At:11 Apr, 2025 | 00:51

Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary2.06.8MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Type: Primary
Version: 2.0
Base score: 6.8
Base severity: MEDIUM
Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
CPE Matches
zikula
zikula
>>zikula_application_framework>>Versions up to 1.2.4(inclusive)
cpe:2.3:a:zikula:zikula_application_framework:*:*:*:*:*:*:*:*
zikula
zikula
>>zikula_application_framework>>1.1.2
cpe:2.3:a:zikula:zikula_application_framework:1.1.2:*:*:*:*:*:*:*
zikula
zikula
>>zikula_application_framework>>1.2.1
cpe:2.3:a:zikula:zikula_application_framework:1.2.1:*:*:*:*:*:*:*
zikula
zikula
>>zikula_application_framework>>1.2.2
cpe:2.3:a:zikula:zikula_application_framework:1.2.2:*:*:*:*:*:*:*
zikula
zikula
>>zikula_application_framework>>1.2.3
cpe:2.3:a:zikula:zikula_application_framework:1.2.3:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-352Primarynvd@nist.gov
CWE ID: CWE-352
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.htmlsecalert@redhat.com
Exploit
http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOGsecalert@redhat.com
N/A
http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-releasedsecalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/02/01/1secalert@redhat.com
Exploit
http://openwall.com/lists/oss-security/2011/02/03/1secalert@redhat.com
Exploit
http://seclists.org/fulldisclosure/2011/Feb/0secalert@redhat.com
Exploit
http://secunia.com/advisories/43114secalert@redhat.com
Vendor Advisory
http://securityreason.com/securityalert/8067secalert@redhat.com
N/A
http://www.osvdb.org/70751secalert@redhat.com
N/A
http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.htmlaf854a3a-2127-422b-91ae-364da2661108
Exploit
http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOGaf854a3a-2127-422b-91ae-364da2661108
N/A
http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-releasedaf854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/02/01/1af854a3a-2127-422b-91ae-364da2661108
Exploit
http://openwall.com/lists/oss-security/2011/02/03/1af854a3a-2127-422b-91ae-364da2661108
Exploit
http://seclists.org/fulldisclosure/2011/Feb/0af854a3a-2127-422b-91ae-364da2661108
Exploit
http://secunia.com/advisories/43114af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://securityreason.com/securityalert/8067af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.osvdb.org/70751af854a3a-2127-422b-91ae-364da2661108
N/A
Hyperlink: http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html
Source: secalert@redhat.com
Resource:
Exploit
Hyperlink: http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/02/01/1
Source: secalert@redhat.com
Resource:
Exploit
Hyperlink: http://openwall.com/lists/oss-security/2011/02/03/1
Source: secalert@redhat.com
Resource:
Exploit
Hyperlink: http://seclists.org/fulldisclosure/2011/Feb/0
Source: secalert@redhat.com
Resource:
Exploit
Hyperlink: http://secunia.com/advisories/43114
Source: secalert@redhat.com
Resource:
Vendor Advisory
Hyperlink: http://securityreason.com/securityalert/8067
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.osvdb.org/70751
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Hyperlink: http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/02/01/1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Hyperlink: http://openwall.com/lists/oss-security/2011/02/03/1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Hyperlink: http://seclists.org/fulldisclosure/2011/Feb/0
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Hyperlink: http://secunia.com/advisories/43114
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Vendor Advisory
Hyperlink: http://securityreason.com/securityalert/8067
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.osvdb.org/70751
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

2431Records found
CVE-2019-6294
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.14% / 34.85%
||
7 Day CHG~0.00%
Published-15 Jan, 2019 | 14:00
Updated-04 Aug, 2024 | 20:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent URI.

Action-Not Available
Vendor-easycmsn/a
Product-easycmsn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2020-9270
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.18% / 39.49%
||
7 Day CHG~0.00%
Published-18 Feb, 2020 | 17:21
Updated-04 Aug, 2024 | 10:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php.

Action-Not Available
Vendor-icehrmn/a
Product-icehrmn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2021-4131
Matching Score-4
Assigner-Protect AI (formerly huntr.dev)
ShareView Details
Matching Score-4
Assigner-Protect AI (formerly huntr.dev)
CVSS Score-6.5||MEDIUM
EPSS-0.14% / 35.35%
||
7 Day CHG~0.00%
Published-18 Dec, 2021 | 06:20
Updated-03 Aug, 2024 | 17:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

Action-Not Available
Vendor-livehelperchatlivehelperchat
Product-live_helper_chatlivehelperchat/livehelperchat
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2020-18265
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.45% / 62.64%
||
7 Day CHG~0.00%
Published-07 Jun, 2021 | 18:24
Updated-04 Aug, 2024 | 14:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_add_member".

Action-Not Available
Vendor-simple-log_projectn/a
Product-simple-logn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-4306
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.26% / 49.11%
||
7 Day CHG~0.00%
Published-11 Oct, 2013 | 21:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that "perform sensitive write actions" via unspecified vectors.

Action-Not Available
Vendor-n/aWikimedia Foundation
Product-mediawikin/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-5984
Matching Score-4
Assigner-JPCERT/CC
ShareView Details
Matching Score-4
Assigner-JPCERT/CC
CVSS Score-8.8||HIGH
EPSS-0.21% / 42.78%
||
7 Day CHG~0.00%
Published-05 Jul, 2019 | 13:20
Updated-04 Aug, 2024 | 20:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Action-Not Available
Vendor-waspthemesWaspThemes
Product-custom_css_proCustom CSS Pro
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-5973
Matching Score-4
Assigner-JPCERT/CC
ShareView Details
Matching Score-4
Assigner-JPCERT/CC
CVSS Score-8.8||HIGH
EPSS-0.14% / 34.27%
||
7 Day CHG~0.00%
Published-05 Jul, 2019 | 13:20
Updated-04 Aug, 2024 | 20:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Action-Not Available
Vendor-sukimalabSUKIMALAB.COM
Product-online_lesson_bookingOnline Lesson Booking
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-6244
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.14% / 34.85%
||
7 Day CHG~0.00%
Published-12 Jan, 2019 | 02:00
Updated-04 Aug, 2024 | 20:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in UsualToolCMS 8.0. cmsadmin/a_sqlbackx.php?t=sql allows CSRF attacks that can execute SQL statements, and consequently execute arbitrary PHP code by writing that code into a .php file.

Action-Not Available
Vendor-usualtooln/a
Product-usualtoolcmsn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-5974
Matching Score-4
Assigner-JPCERT/CC
ShareView Details
Matching Score-4
Assigner-JPCERT/CC
CVSS Score-8.8||HIGH
EPSS-0.24% / 46.79%
||
7 Day CHG~0.00%
Published-05 Jul, 2019 | 13:20
Updated-04 Aug, 2024 | 20:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Action-Not Available
Vendor-contest-galleryContest-Gallery
Product-contest_galleryContest Gallery
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2017-18512
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.09% / 26.77%
||
7 Day CHG~0.00%
Published-14 Aug, 2019 | 15:32
Updated-05 Aug, 2024 | 21:28
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.

Action-Not Available
Vendor-supsysticn/a
Product-newsletter_by_supsysticn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2017-18511
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.09% / 26.77%
||
7 Day CHG~0.00%
Published-14 Aug, 2019 | 15:38
Updated-05 Aug, 2024 | 21:28
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.

Action-Not Available
Vendor-n/aIncsub, LLC
Product-custom_sidebarsn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2017-16565
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.14% / 34.37%
||
7 Day CHG~0.00%
Published-06 Nov, 2017 | 08:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests.

Action-Not Available
Vendor-grandstreamn/a
Product-ht802_firmwareht802n/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-4405
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.13% / 33.75%
||
7 Day CHG~0.00%
Published-23 Dec, 2013 | 22:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allow remote attackers to hijack the authentication of cumin users for unspecified requests.

Action-Not Available
Vendor-n/aRed Hat, Inc.
Product-enterprise_mrgn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-4726
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-0.13% / 33.55%
||
7 Day CHG~0.00%
Published-25 Apr, 2014 | 17:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

Action-Not Available
Vendor-ddsnn/a
Product-cm3_acora_content_management_systemn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2017-1672
Matching Score-4
Assigner-IBM Corporation
ShareView Details
Matching Score-4
Assigner-IBM Corporation
CVSS Score-8.8||HIGH
EPSS-0.13% / 33.42%
||
7 Day CHG~0.00%
Published-04 Jan, 2018 | 17:00
Updated-17 Sep, 2024 | 02:27
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 133639.

Action-Not Available
Vendor-IBM Corporation
Product-security_key_lifecycle_managerSecurity Key Lifecycle Manager
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2021-41916
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.19% / 41.49%
||
7 Day CHG~0.00%
Published-08 Oct, 2021 | 15:31
Updated-04 Aug, 2024 | 03:22
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add a new user to the new profile. without the victim's knowledge, by enticing an authenticated admin user to visit an attacker's web page.

Action-Not Available
Vendor-webtareas_projectn/a
Product-webtareasn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-6027
Matching Score-4
Assigner-JPCERT/CC
ShareView Details
Matching Score-4
Assigner-JPCERT/CC
CVSS Score-8.8||HIGH
EPSS-0.13% / 32.68%
||
7 Day CHG~0.00%
Published-26 Dec, 2019 | 15:16
Updated-04 Aug, 2024 | 20:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Action-Not Available
Vendor-wpspellcheckWP Spell Check
Product-wpspellcheckWP Spell Check
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3694
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-0.13% / 33.00%
||
7 Day CHG~0.00%
Published-16 Nov, 2013 | 02:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding.

Action-Not Available
Vendor-n/aBlackBerry LimitedApple Inc.Microsoft Corporation
Product-windowsmac_os_xblackberry_linkn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-5920
Matching Score-4
Assigner-JPCERT/CC
ShareView Details
Matching Score-4
Assigner-JPCERT/CC
CVSS Score-8.8||HIGH
EPSS-0.24% / 46.79%
||
7 Day CHG~0.00%
Published-12 Mar, 2019 | 21:00
Updated-04 Aug, 2024 | 20:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page.

Action-Not Available
Vendor-ncraftsnCrafts
Product-formcraftFormCraft
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-5992
Matching Score-4
Assigner-JPCERT/CC
ShareView Details
Matching Score-4
Assigner-JPCERT/CC
CVSS Score-8.8||HIGH
EPSS-0.09% / 27.13%
||
7 Day CHG~0.00%
Published-12 Sep, 2019 | 15:58
Updated-04 Aug, 2024 | 20:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Action-Not Available
Vendor-ultra-prodWordPress Ultra Simple Paypal Shopping Cart
Product-wordpress_ultra_simple_paypal_shopping_cartv4.4 and earlier
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-5430
Matching Score-4
Assigner-HackerOne
ShareView Details
Matching Score-4
Assigner-HackerOne
CVSS Score-8.8||HIGH
EPSS-0.19% / 40.66%
||
7 Day CHG~0.00%
Published-06 May, 2019 | 16:53
Updated-04 Aug, 2024 | 19:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In UniFi Video 3.10.0 and prior, due to the lack of CSRF protection, it is possible to abuse the Web API to make changes on the server configuration without the user consent, requiring the attacker to lure an authenticated user to access on attacker controlled page.

Action-Not Available
Vendor-n/aUbiquiti Inc.
Product-unifi_videoUniFi Video Server
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2012-2056
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.17% / 38.83%
||
7 Day CHG~0.00%
Published-17 Sep, 2012 | 20:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the Content Lock module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

Action-Not Available
Vendor-nathan_brinkn/aThe Drupal Association
Product-content_lockdrupaln/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2021-45268
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.31% / 53.33%
||
7 Day CHG~0.00%
Published-03 Feb, 2022 | 21:46
Updated-04 Aug, 2024 | 05:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cookie of a high-privileged authenticated user who is entitled to install arbitrary add-ons

Action-Not Available
Vendor-backdropcmsn/a
Product-backdropn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3963
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-0.22% / 44.70%
||
7 Day CHG~0.00%
Published-01 Oct, 2013 | 19:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models allows remote attackers to hijack the authentication of unspecified victims for requests that add users.

Action-Not Available
Vendor-grandstreamn/a
Product-gxv3501gxv_device_firmwaregxv3611hd\/llgxv3615w\/pgxv3615wp_hdgxv3504gxv3651fhdgxv3500gxv3601gxv3662hdgxv3601hd\/lln/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-4227
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-8.8||HIGH
EPSS-0.15% / 35.56%
||
7 Day CHG~0.00%
Published-18 Feb, 2020 | 14:08
Updated-06 Aug, 2024 | 16:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type.

Action-Not Available
Vendor-Mozilla Corporation
Product-personaPersona
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-4555
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.29% / 52.37%
||
7 Day CHG~0.00%
Published-15 Nov, 2013 | 18:16
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors.

Action-Not Available
Vendor-spipn/a
Product-spipn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3935
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-8.8||HIGH
EPSS-0.13% / 33.31%
||
7 Day CHG~0.00%
Published-02 Jan, 2020 | 14:31
Updated-06 Aug, 2024 | 16:22
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors.

Action-Not Available
Vendor-opsviewOpsview
Product-opsviewopsview_coreOpsview CoreOpsview
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-4562
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.48% / 64.13%
||
7 Day CHG~0.00%
Published-13 May, 2014 | 15:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

Action-Not Available
Vendor-madeofcoden/a
Product-omniauth-facebookn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-2692
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-6.8||MEDIUM
EPSS-0.18% / 40.17%
||
7 Day CHG~0.00%
Published-13 May, 2014 | 14:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows remote attackers to hijack the authentication of administrators for requests that create administrative users.

Action-Not Available
Vendor-openvpnn/a
Product-openvpn_access_servern/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-2702
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-6.8||MEDIUM
EPSS-0.13% / 32.91%
||
7 Day CHG~0.00%
Published-05 May, 2013 | 10:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the Easy AdSense Lite plugin before 6.10 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.

Action-Not Available
Vendor-thulasidasn/aWordPress.org
Product-wordpresseasy-adsense-liten/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3451
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.12% / 30.94%
||
7 Day CHG~0.00%
Published-03 Aug, 2013 | 01:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Unified Communications Manager (Unified CM) allow remote attackers to hijack the authentication of arbitrary users for requests that perform arbitrary Unified CM operations, aka Bug ID CSCui13033.

Action-Not Available
Vendor-n/aCisco Systems, Inc.
Product-unified_communications_managern/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-2706
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-6.8||MEDIUM
EPSS-0.16% / 37.95%
||
7 Day CHG~0.00%
Published-11 Apr, 2014 | 14:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the Stream Video Player plugin 1.4.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.

Action-Not Available
Vendor-rodrigo_polon/aWordPress.org
Product-wordpressstream_video_playern/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-2700
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-6.8||MEDIUM
EPSS-0.25% / 48.26%
||
7 Day CHG~0.00%
Published-14 May, 2014 | 19:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that add or edit an ad via unspecified vectors.

Action-Not Available
Vendor-webmaster-sourcen/a
Product-wp125n/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-2628
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-0.13% / 33.55%
||
7 Day CHG~0.00%
Published-21 Dec, 2013 | 00:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple cross-site request forgery (CSRF) vulnerabilities in action.php in Leed (Light Feed), possibly before 1.5 Stable, allow remote attackers to hijack the authentication of administrators for unspecified requests, related to the lack of an anti-CSRF token.

Action-Not Available
Vendor-idlemann/a
Product-leedn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3098
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-0.35% / 56.62%
||
7 Day CHG~0.00%
Published-04 Feb, 2014 | 16:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple cross-site request forgery (CSRF) vulnerabilities in TRENDnet TEW-812DRU router with firmware before 1.0.9.0 allow remote attackers to hijack the authentication of administrators for requests that (1) change admin credentials in a request to setSysAdm.cgi, (2) enable remote management or (3) enable port forwarding in an Apply action to uapply.cgi, or (4) have unspecified impact via a request to setNTP.cgi. NOTE: some of these details are obtained from third party information.

Action-Not Available
Vendor-n/aTRENDnet, Inc.
Product-tew-812drutew-812dru_firmwaren/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3420
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.12% / 32.06%
||
7 Day CHG~0.00%
Published-17 Jul, 2013 | 21:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the web framework on the Cisco Identity Services Engine (ISE) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuh25506.

Action-Not Available
Vendor-n/aCisco Systems, Inc.
Product-identity_services_engine_softwareidentity_services_enginen/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-2696
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-6.8||MEDIUM
EPSS-0.13% / 33.59%
||
7 Day CHG~0.00%
Published-25 Apr, 2013 | 20:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Action-Not Available
Vendor-crunchifyn/aWordPress.org
Product-all-in-on-webmasterwordpressn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3252
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-6.8||MEDIUM
EPSS-0.18% / 39.80%
||
7 Day CHG~0.00%
Published-10 Apr, 2014 | 14:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.

Action-Not Available
Vendor-lesterchann/a
Product-wp-postviewsn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2019-5924
Matching Score-4
Assigner-JPCERT/CC
ShareView Details
Matching Score-4
Assigner-JPCERT/CC
CVSS Score-8.8||HIGH
EPSS-3.83% / 87.69%
||
7 Day CHG~0.00%
Published-12 Mar, 2019 | 21:00
Updated-04 Aug, 2024 | 20:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page.

Action-Not Available
Vendor-rednaoRedNao
Product-smart_formsSmart Forms
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3395
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.12% / 32.06%
||
7 Day CHG~0.00%
Published-02 Jul, 2013 | 01:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the web framework on Cisco IronPort Web Security Appliance (WSA) devices, Email Security Appliance (ESA) devices, and Content Security Management Appliance (SMA) devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuh70263, CSCuh70323, and CSCuh26634.

Action-Not Available
Vendor-n/aCisco Systems, Inc.
Product-email_security_appliance_firmwareweb_security_appliancecontent_security_management_appliancen/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2021-40662
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.79% / 72.87%
||
7 Day CHG~0.00%
Published-21 Mar, 2022 | 20:39
Updated-04 Aug, 2024 | 02:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interaction with a crafted URL.

Action-Not Available
Vendor-chamilon/a
Product-chamilon/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3397
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.12% / 30.94%
||
7 Day CHG~0.00%
Published-26 Jun, 2013 | 21:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the Unified Serviceability component in Cisco Unified Communications Manager (CUCM) allows remote attackers to hijack the authentication of arbitrary users for requests that perform Unified Serviceability actions, aka Bug ID CSCuh10298.

Action-Not Available
Vendor-n/aCisco Systems, Inc.
Product-unified_communications_managern/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3095
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-0.43% / 61.69%
||
7 Day CHG~0.00%
Published-19 Nov, 2013 | 15:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR865L router (Rev. A1) with firmware before 1.05b07 allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password or (2) enable remote management via a request to hedwig.cgi or (3) activate configuration changes via a request to pigwidgeon.cgi.

Action-Not Available
Vendor-n/aD-Link Corporation
Product-dir865ldir865l_firmwaren/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2021-4168
Matching Score-4
Assigner-Protect AI (formerly huntr.dev)
ShareView Details
Matching Score-4
Assigner-Protect AI (formerly huntr.dev)
CVSS Score-6.3||MEDIUM
EPSS-0.14% / 35.36%
||
7 Day CHG~0.00%
Published-26 Dec, 2021 | 13:20
Updated-03 Aug, 2024 | 17:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cross-Site Request Forgery (CSRF) in star7th/showdoc

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

Action-Not Available
Vendor-showdocstar7th
Product-showdocstar7th/showdoc
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-2693
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-6.8||MEDIUM
EPSS-0.18% / 39.80%
||
7 Day CHG~0.00%
Published-10 Apr, 2014 | 14:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the Options in the WP-Print plugin before 2.52 for WordPress allows remote attackers to hijack the authentication of administrators for requests that manipulate plugin settings via unspecified vectors.

Action-Not Available
Vendor-wp-pluginsn/a
Product-wp-printn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-2709
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-6.8||MEDIUM
EPSS-0.12% / 32.47%
||
7 Day CHG~0.00%
Published-26 Apr, 2013 | 10:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins plugin before 1.3 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Action-Not Available
Vendor-crunchifyn/aWordPress.org
Product-foursquare-checkinswordpressn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-2707
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-6.8||MEDIUM
EPSS-0.12% / 32.47%
||
7 Day CHG~0.00%
Published-10 May, 2013 | 10:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.

Action-Not Available
Vendor-netweblogicn/aWordPress.org
Product-login_with_ajaxwordpressn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3250
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-6.8||MEDIUM
EPSS-0.09% / 27.15%
||
7 Day CHG~0.00%
Published-21 Jun, 2013 | 20:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.

Action-Not Available
Vendor-n/aWordPress.org
Product-wp_maintenance_mode_pluginn/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3583
Matching Score-4
Assigner-CERT/CC
ShareView Details
Matching Score-4
Assigner-CERT/CC
CVSS Score-6.8||MEDIUM
EPSS-0.07% / 22.88%
||
7 Day CHG~0.00%
Published-28 Aug, 2013 | 01:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in saveProperties.html in Corporater EPM Suite allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords.

Action-Not Available
Vendor-corporatern/a
Product-epm_suiten/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2013-3568
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-41.06% / 97.29%
||
7 Day CHG~0.00%
Published-06 Feb, 2020 | 21:54
Updated-06 Aug, 2024 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.

Action-Not Available
Vendor-n/aCisco Systems, Inc.
Product-linksys_wrt110_firmwarelinksys_wrt110n/a
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
  • Previous
  • 1
  • 2
  • 3
  • 4
  • 5
  • ...
  • 48
  • 49
  • Next
Details not found