Total
5731 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-10249 | 1 Baijiacms Project | 1 Baijiacms | 2018-05-22 | 6.8 MEDIUM | 8.8 HIGH |
| baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account. | |||||
| CVE-2018-10248 | 1 Wuzhicms | 1 Wuzhi Cms | 2018-05-21 | 5.8 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can delete any article via index.php?m=content&f=content&v=recycle_delete. | |||||
| CVE-2018-10188 | 1 Phpmyadmin | 1 Phpmyadmin | 2018-05-21 | 6.8 MEDIUM | 8.8 HIGH |
| phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php. | |||||
| CVE-2018-10185 | 1 Tuzicms | 1 Tuzicms | 2018-05-21 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in TuziCMS v2.0.6. There is a CSRF vulnerability that can add an admin account, as demonstrated by a history.pushState call. | |||||
| CVE-2016-5809 | 1 Schneider-electric | 6 Ion5000, Ion7300, Ion7500 and 3 more | 2018-05-20 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. There is no CSRF Token generated to authenticate the user during a session. Successful exploitation of this vulnerability can allow unauthorized configuration changes to be made and saved. | |||||
| CVE-2018-10117 | 1 Icmsdev | 1 Icms | 2018-05-18 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in idreamsoft iCMS V7.0.7. There is a CSRF vulnerability that can add an admin account via admincp.php?app=members&do=save&frame=iPHP. | |||||
| CVE-2018-10224 | 1 Yzmcms | 1 Yzmcms | 2018-05-17 | 6.0 MEDIUM | 6.8 MEDIUM |
| An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html. | |||||
| CVE-2018-10223 | 1 Yzmcms | 1 Yzmcms | 2018-05-17 | 6.0 MEDIUM | 6.8 MEDIUM |
| An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/admin_manage/add.html. | |||||
| CVE-2018-1000153 | 1 Jenkins | 1 Vsphere | 2018-05-15 | 6.8 MEDIUM | 8.8 HIGH |
| A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection"). | |||||
| CVE-2018-6874 | 1 Auth0 | 1 Auth0.js | 2018-05-15 | 6.8 MEDIUM | 8.8 HIGH |
| CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. | |||||
| CVE-2018-9856 | 1 Kotti Project | 1 Kotti | 2018-05-15 | 6.8 MEDIUM | 8.8 HIGH |
| Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request. | |||||
| CVE-2017-0362 | 2 Debian, Mediawiki | 2 Debian Linux, Mediawiki | 2018-05-15 | 6.8 MEDIUM | 8.8 HIGH |
| Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token. | |||||
| CVE-2018-10127 | 1 Xyhcms Project | 1 Xyhcms | 2018-05-11 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser request, resulting in addition of an account with the administrator role. | |||||
| CVE-2018-6934 | 1 Ordermanagementscript | 1 Online Tutoring Script | 2018-05-11 | 6.8 MEDIUM | 8.8 HIGH |
| CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3. | |||||
| CVE-2018-8814 | 1 Wolfcms | 1 Wolf Cms | 2018-05-09 | 5.8 MEDIUM | 6.5 MEDIUM |
| Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication of users for requests that modify plugin/[pluginname]/settings by crafting a malicious request. | |||||
| CVE-2014-5072 | 1 Wpsecurityauditlog | 1 Wp Security Audit Log | 2018-05-09 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. | |||||
| CVE-2014-5034 | 1 Fresh-media | 1 Brute Force Login Protection | 2018-05-09 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that have unknown impact via a crafted request to the brute-force-login-protection page to wp-admin/options-general.php. | |||||
| CVE-2018-8908 | 1 Frog Cms Project | 1 Frog Cms | 2018-05-09 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into clicking on it; once executed, a malicious user will be created with admin privileges. This happens due to lack of an anti-CSRF token in state modification requests. | |||||
| CVE-2018-10048 | 1 Iscripts | 1 Eswap | 2018-05-09 | 6.8 MEDIUM | 8.8 HIGH |
| iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel. | |||||
| CVE-2018-8893 | 1 Zblogcn | 1 Z-blogphp | 2018-05-01 | 6.8 MEDIUM | 8.8 HIGH |
| Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code. | |||||