ByteOS

Resource:

third-party-advisory

x_refsource_SECUNIA

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://packetstormsecurity.org/files/109706/PBBoard-2.1.4-Cross-Site-Request-Forgery-Shell-Upload.html	x_refsource_MISC x_transferred
http://secunia.com/advisories/47948	third-party-advisory x_refsource_SECUNIA x_transferred

Hyperlink: http://packetstormsecurity.org/files/109706/PBBoard-2.1.4-Cross-Site-Request-Forgery-Shell-Upload.html

Resource:

x_refsource_MISC

x_transferred

cpe:2.3:a:pbboard:pbboard:2.1.4:*:*:*:*:*:*:*

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:21 Feb, 2012 | 13:31

Updated At:11 Apr, 2025 | 00:51

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 2.0

Base score: 6.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

pbboard>>pbboard>>2.1.4

Weaknesses

CWE ID	Type	Source
CWE-352	Primary	nvd@nist.gov

CWE ID: CWE-352

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://packetstormsecurity.org/files/109706/PBBoard-2.1.4-Cross-Site-Request-Forgery-Shell-Upload.html	cve@mitre.org	Exploit
http://secunia.com/advisories/47948	cve@mitre.org	Vendor Advisory
http://packetstormsecurity.org/files/109706/PBBoard-2.1.4-Cross-Site-Request-Forgery-Shell-Upload.html	af854a3a-2127-422b-91ae-364da2661108	Exploit
http://secunia.com/advisories/47948	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory

Hyperlink: http://packetstormsecurity.org/files/109706/PBBoard-2.1.4-Cross-Site-Request-Forgery-Shell-Upload.html

Source: cve@mitre.org

Resource:

Exploit

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: http://packetstormsecurity.org/files/109706/PBBoard-2.1.4-Cross-Site-Request-Forgery-Shell-Upload.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Similar CVEs

2432Records found

CVE-2012-4036

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-5.21% / 89.69%

7 Day CHG~0.00%

Published-27 Aug, 2012 | 23:00

Updated-11 Apr, 2025 | 00:51

Unrestricted file upload vulnerability in admin.php in PBBoard 2.1.4 allows remote administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the addons directory. NOTE: this vulnerability can be leveraged by remote attackers using CVE-2012-1216.

Vendor-pbboard n/a

Product-pbboard n/a

CVE-2015-1485

Matching Score-4

Assigner-Symantec - A Division of Broadcom

Matching Score-4

Assigner-Symantec - A Division of Broadcom

CVSS Score-6.8||MEDIUM

EPSS-0.16% / 36.58%

7 Day CHG~0.00%

Published-28 Jun, 2015 | 19:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 12.5.2 allows remote attackers to hijack the authentication of administrators.

Vendor-n/a Symantec Corporation

Product-data_loss_prevention n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-1568

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.13% / 32.08%

7 Day CHG~0.00%

Published-09 Feb, 2015 | 17:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote attackers to hijack the authentication of users with the "edit gd infinite scroll settings" permission for requests that delete settings via unspecified vectors.

Vendor-studio.gd n/a

Product-gd_infinite_scroll n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0895

Matching Score-4

Assigner-JPCERT/CC

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-6.8||MEDIUM

EPSS-0.14% / 33.55%

7 Day CHG~0.00%

Published-07 Mar, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.

Vendor-n/a Tips and Tricks HQ

Product-all_in_one_wordpress_security_and_firewall n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-1585

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.29% / 51.73%

7 Day CHG~0.00%

Published-19 Feb, 2015 | 15:00

Updated-12 Apr, 2025 | 10:46

Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.

Vendor-fatfreecrm n/a

Product-fat_free_crm n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2021-1257

Matching Score-4

Assigner-Cisco Systems, Inc.

Vendor-Cisco Systems, Inc.Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc McAfee, LLC

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-7.1||HIGH

EPSS-0.12% / 31.74%

7 Day CHG~0.00%

Published-20 Jan, 2021 | 19:57

Updated-23 Jul, 2025 | 15:26

Cisco DNA Center Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to manipulate an authenticated user into executing malicious actions without their awareness or consent. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a web-based management user to follow a specially crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the device with the privileges of the authenticated user. These actions include modifying the device configuration, disconnecting the user's session, and executing Command Runner commands.

Product-linux_kernel windows agent macos catalyst_center Cisco Digital Network Architecture Center (DNA Center)

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-1771

Matching Score-4

Assigner-Microsoft Corporation

Matching Score-4

Assigner-Microsoft Corporation

CVSS Score-6.8||MEDIUM

EPSS-2.01% / 83.38%

7 Day CHG~0.00%

Published-10 Jun, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in the web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allows remote attackers to hijack the authentication of arbitrary users, aka "Exchange Cross-Site Request Forgery Vulnerability."

Vendor-n/a Microsoft Corporation

Product-exchange_server n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-1432

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.51% / 65.77%

7 Day CHG~0.00%

Published-10 Feb, 2015 | 17:00

Updated-12 Apr, 2025 | 10:46

The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.

Vendor-phpbb n/a

Product-phpbb n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2018-7176

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.18% / 39.00%

7 Day CHG~0.00%

Published-16 Feb, 2018 | 04:00

Updated-05 Aug, 2024 | 06:24

FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page).

Vendor-frontaccounting n/a

Product-frontaccounting n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-1581

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.10% / 26.65%

7 Day CHG~0.00%

Published-11 Feb, 2015 | 19:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) domain, (3) text, (4) font, (5) fontcolor, (6) color, or (7) padding parameter in an add-domain action in the mobile-domain page to wp-admin/options-general.php.

Vendor-mobile_domain_project n/a

Product-mobile_domain n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0970

Matching Score-4

Assigner-CERT/CC

Matching Score-4

Assigner-CERT/CC

CVSS Score-8.8||HIGH

EPSS-0.22% / 44.11%

7 Day CHG~0.00%

Published-18 Apr, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users.

Vendor-searchblox n/a

Product-searchblox n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0905

Matching Score-4

Assigner-JPCERT/CC

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-6.8||MEDIUM

EPSS-0.17% / 38.69%

7 Day CHG~0.00%

Published-08 Apr, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users.

Vendor-bblog_project n/a

Product-bblog n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2018-7307

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.20% / 42.29%

7 Day CHG~0.00%

Published-06 Mar, 2018 | 15:00

Updated-05 Aug, 2024 | 06:24

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.

Vendor-auth0 n/a

Product-auth0.js n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2018-19104

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.46% / 63.53%

7 Day CHG~0.00%

Published-08 Nov, 2018 | 08:00

Updated-05 Aug, 2024 | 11:30

In BageCMS 3.1.3, upload/index.php has a CSRF vulnerability that can be used to upload arbitrary files and get server privileges.

Vendor-bagesoft n/a

Product-bagecms n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-1614

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.14% / 34.20%

7 Day CHG~0.00%

Published-19 Feb, 2015 | 15:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) image_metadata_cruncher[alt] or (2) image_metadata_cruncher[caption] parameter in an update action in the image_metadata_cruncher_title page to wp-admin/options.php or (3) custom image meta tag to the image metadata cruncher page.

Vendor-image_metadata_cruncher_project n/a

Product-image_metadata_cruncher n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-1424

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.56% / 67.64%

7 Day CHG~0.00%

Published-29 Jan, 2015 | 15:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.

Vendor-jakweb n/a

Product-gecko_cms n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-1374

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-1.65% / 81.64%

7 Day CHG~0.00%

Published-27 Jan, 2015 | 17:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication of administrators for requests that conduct (1) cross-site scripting (XSS), (2) SQL injection, or (3) unrestricted file upload attacks.

Vendor-ferretcms_project n/a

Product-ferretcms n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-1786

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-8.8||HIGH

EPSS-0.11% / 30.08%

7 Day CHG~0.00%

Published-08 Jun, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.

Vendor-n/a Perforce Software, Inc.

Product-zend_framework n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0920

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.10% / 28.55%

7 Day CHG~0.00%

Published-08 Jan, 2015 | 15:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the banner_effect_email parameter in the BannerEffectOptions page to wp-admin/options-general.php.

Vendor-banner_effect_header_project n/a

Product-banner_effect_header n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2014-8031

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.17% / 38.75%

7 Day CHG~0.00%

Published-09 Jan, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj40456.

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Product-webex_meetings_server n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0985

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Matching Score-4

CVSS Score-6.8||MEDIUM

EPSS-0.07% / 21.83%

7 Day CHG~0.00%

Published-31 Mar, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that modify the default user's password via a GET request.

Vendor-xzeres n/a

Product-442sr_os 442sr n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0588

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.17% / 38.57%

7 Day CHG~0.00%

Published-15 Jan, 2015 | 22:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo77055.

Product-unified_communications_domain_manager n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0218

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.13% / 32.06%

7 Day CHG~0.00%

Published-01 Jun, 2015 | 19:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.

Vendor-n/a Moodle Pty Ltd

Product-moodle n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0704

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.11% / 29.01%

7 Day CHG~0.00%

Published-22 Apr, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site request forgery (CSRF) vulnerabilities in API features in Cisco Unified MeetingPlace 8.6(1.9) allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus95884.

Product-unified_meetingplace n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2018-7590

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.13% / 33.20%

7 Day CHG~0.00%

Published-01 Mar, 2018 | 21:00

Updated-05 Aug, 2024 | 06:31

CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation.

Vendor-hoosk n/a

Product-hoosk n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2011-5011

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.78% / 73.21%

7 Day CHG~0.00%

Published-25 Dec, 2011 | 01:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site request forgery (CSRF) vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that (1) set a New user to Admin via the cID parameter to a statusconfirm action in admin/customers.php and (2) grant permissions to users via the cID parameter to a save action in admin/accounting.php.

Vendor-xt-commerce n/a

Product-xt-commerce n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0651

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.13% / 33.14%

7 Day CHG~0.00%

Published-27 Feb, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753.

Product-application_networking_manager n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0716

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.12% / 30.46%

7 Day CHG~0.00%

Published-07 May, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in the CUCReports page in Cisco Unity Connection 11.0(0.98000.225) and 11.0(0.98000.332) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut33659.

Product-unity_connection n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0740

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.12% / 31.05%

7 Day CHG~0.00%

Published-20 May, 2015 | 00:00

Updated-31 Jul, 2025 | 15:03

Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus28826.

Product-unified_intelligence_center n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0542

Matching Score-4

Assigner-Dell

Matching Score-4

Assigner-Dell

CVSS Score-6.8||MEDIUM

EPSS-0.13% / 32.08%

7 Day CHG~0.00%

Published-20 Aug, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site request forgery (CSRF) vulnerabilities in EMC RSA Archer GRC 5.5 SP1 before P3 allow remote attackers to hijack the authentication of arbitrary users.

Vendor-n/a ELAN Microelectronics Corporation

Product-rsa_archer_egrc n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2019-10642

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.15% / 35.01%

7 Day CHG~0.00%

Published-17 Apr, 2019 | 18:54

Updated-04 Aug, 2024 | 22:31

Contao 4.7 allows CSRF.

Vendor-n/a Contao Association

Product-contao_cms n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0807

Matching Score-4

Assigner-Mozilla Corporation

Matching Score-4

Assigner-Mozilla Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.14% / 33.70%

7 Day CHG~0.00%

Published-01 Apr, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.

Vendor-n/a Mozilla Corporation

Product-firefox firefox_esr thunderbird n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2018-7828

Matching Score-4

Assigner-Schneider Electric

Product-ime219-1ep_firmware ime119-1es ime319-1ei_firmware ime219-1vi_firmware ime3122-1vp_firmware ime219-1vs_firmware ime319-1vs_firmware ime219-1es d6220 ime219-1vp_firmware ixe31 imes19-1ei ime3122-1vp imes19-1s ime3122-1ep ime219-1vi imes19-1es ime319-1ei ime3122-1i imes19-1ep_firmware imes19-1es_firmware d6220_firmware ime3122-b1i imes19-1s_firmware ime3122-b1s_firmware ime119-1vi_firmware d6230_firmware ime319-1s_firmware ime319-b1p_firmware ime319-1p ime3122-b1p ime319-1ep_firmware ime319-1vs ime119-1vp_firmware ime219-1vp ime219-1i ime3122-1es ixe21_firmware ime319-1p_firmware ime3122-1i_firmware ime319-1vi imes19-1vs ime119-1vi imes19-1vp_firmware ime119-1p ime3122-1vs_firmware ime219-1es_firmware ime319-1vp imes19-1vp ime3122-1ei ime319-b1s_firmware imes19-1ei_firmware ime119-1ei_firmware ime219-1p ixe11_firmware ime3122-1ei_firmware ime119-1vp ime319-b1i ixe31_firmware ime119-1vs_firmware ixes1 ime219-1p_firmware ime3122-1ep_firmware ime3122-1vi_firmware ime219-1s_firmware ime119-1vs ime119-1es_firmware imes19-1ep ime219-1ep ime319-1vi_firmware ime119-1i_firmware ime119-1ei ime319-1i imes19-1i ime319-b1s ime3122-1p_firmware imes19-1vi_firmware imes19-1vs_firmware ime3122-1s ime119-1i imes19-1vi imes19-1i_firmware ime319-1vp_firmware ime319-1i_firmware imes19-1p ime219-1s ime319-b1i_firmware ime3122-1s_firmware ime219-1i_firmware ime3122-1vi ixe21 d6230l ime119-1p_firmware ime219-1ei ime319-1es_firmware d6230l_firmware ime319-b1p ime319-1es d6230 ime3122-b1s ime219-1ei_firmware ime119-1ep d6220l ime3122-1vs ime219-1vs imes19-1p_firmware ime319-1ep ime3122-1es_firmware ime119-1s ime119-1ep_firmware d6220l_firmware ixes1_firmware ime3122-b1i_firmware ime3122-b1p_firmware ime319-1s ixe11 ime119-1s_firmware ime3122-1p Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ

Matching Score-4

Assigner-Schneider Electric

CVSS Score-8.8||HIGH

EPSS-0.24% / 47.06%

7 Day CHG~0.00%

Published-22 May, 2019 | 19:34

Updated-05 Aug, 2024 | 06:37

A Cross-Site Request Forgery (CSRF) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera when an authenticated user clicks a specially crafted malicious link while logged into the camera.

Vendor-n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0145

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.10% / 28.38%

7 Day CHG~0.00%

Published-03 Oct, 2015 | 22:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Vendor-n/a IBM Corporation

Product-openpages_grc_platform n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2021-21495

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.21% / 43.20%

7 Day CHG~0.00%

Published-04 Jan, 2021 | 02:05

Updated-03 Aug, 2024 | 18:16

MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar_central.php?acao=altsenha_princ URI.

Vendor-mk-auth n/a

Product-mk-auth n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2011-4281

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.13% / 32.07%

7 Day CHG~0.00%

Published-16 Jul, 2012 | 10:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of (1) an activity or (2) a course.

Vendor-n/a Moodle Pty Ltd

Product-moodle n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0596

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.32% / 54.75%

7 Day CHG~0.00%

Published-02 Feb, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj67163.

Product-webex_meetings_server n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0741

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.12% / 31.05%

7 Day CHG~0.00%

Published-21 May, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.

Product-hosted_collaboration_solution n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0736

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.11% / 29.01%

7 Day CHG~0.00%

Published-16 May, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in Cisco MediaSense 10.5(1) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu16728.

Product-mediasense n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0213

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.13% / 32.06%

7 Day CHG~0.00%

Published-01 Jun, 2015 | 19:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.

Vendor-n/a Moodle Pty Ltd

Product-moodle n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0151

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-8.8||HIGH

EPSS-0.13% / 32.96%

7 Day CHG-0.04%

Published-12 Apr, 2018 | 21:00

Updated-06 Aug, 2024 | 04:03

Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Vendor-n/a D-Link Corporation

Product-dir-815_firmware dir-815 n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2011-4952

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-8.8||HIGH

EPSS-0.27% / 50.43%

7 Day CHG~0.00%

Published-19 Nov, 2019 | 15:29

Updated-07 Aug, 2024 | 00:23

cobbler: Web interface lacks CSRF protection when using Django framework

Vendor-cobblerd cobbler

Product-cobbler cobbler

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0759

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.11% / 29.01%

7 Day CHG~0.00%

Published-02 Jun, 2015 | 14:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in Cisco Headend Digital Broadband Delivery System allows remote attackers to hijack the authentication of arbitrary users.

Product-headend_digital_broadband_delivery_system n/a

CWE ID-CWE-20

Improper Input Validation

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2011-4133

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.13% / 32.07%

7 Day CHG~0.00%

Published-16 Jul, 2012 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block.

Vendor-n/a Moodle Pty Ltd

Product-moodle n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2015-0705

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.41% / 60.78%

7 Day CHG~0.00%

Published-22 Apr, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in the SOAP API endpoints of the web-services directory in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts, aka Bug ID CSCus97494.

Product-unified_meetingplace n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2014-9344

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.58% / 68.25%

7 Day CHG~0.00%

Published-08 Dec, 2014 | 16:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in Snowfox CMS before 1.0.10 allows remote attackers to hijack the authentication of administrators for requests that add a new admin account via a submit action in the admin/accounts/create uri to snowfox/.

Vendor-globiz_solutions n/a

Product-snowfox_content_management_system n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2014-9335

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.10% / 26.65%

7 Day CHG~0.00%

Published-19 Dec, 2014 | 15:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site request forgery (CSRF) vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) email_address or (2) sidebarTitle parameter in the dandyid-services.php page to wp-admin/options-general.php.

Vendor-dandyid_services_project n/a

Product-dandyid_services n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2014-8925

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.15% / 35.32%

7 Day CHG~0.00%

Published-25 Mar, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site request forgery (CSRF) vulnerability in ClearQuest Web in IBM Rational ClearQuest 7.1.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout or insert XSS sequences.

Vendor-n/a IBM Corporation

Product-rational_clearquest n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2014-9523

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.10% / 26.65%

7 Day CHG~0.00%

Published-05 Jan, 2015 | 20:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced) plugin before 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_our_team_member_count parameter in the sc_team_settings page to wp-admin/edit.php.

Vendor-smartcat n/a

Product-our_team_showcase n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2018-6934

Matching Score-4

Assigner-MITRE Corporation