Multiple cross-site request forgery (CSRF) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to hijack the authentication of arbitrary users for requests that modify (1) passwords (2) accounts or (3) permissions.


Mozilla Firefox before 17.0 Thunderbird before 17.0 and SeaMonkey before 2.14 assign the system principal rather than the sandbox principal to XMLHttpRequest objects created in sandboxes which allows remote attackers to conduct cross-site request forgery (CSRF) attacks or obtain sensitive information by leveraging a sandboxed add-on.


in

Apache

Tomcat

before

and

before

allows

remote

attackers

to

bypass

the

cross-site

request

forgery

(CSRF)

protection

mechanism

via

a

request

that

lacks

a

session

identifier.


Multiple cross-site request forgery (CSRF) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to hijack the authentication of administrators for requests that (1) remove file access restriction via a deletehtaccess action (2) drop a database via a kill value in a db action (3) uninstall the application via a 101 value in the phase parameter to learn/cubemail/install.php (4) delete config.php via a 2 value in the phase parameter to learn/cubemail/install.php (5) change a password via a schutz action or (6) execute arbitrary SQL commands via the sql_statement parameter to learn/cubemail/sql.php.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable a server via a server action or (2) enable a search index via an enable index action.


Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS message.


Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to (1) viewCustomers (2) viewPayGrades or (3) viewSystemUsers in symfony/web/index.php/admin/ as demonstrated using cross-site request forgery (CSRF) attacks.


Cross-site request forgery (CSRF) vulnerability in setup/security.cgi in D-Link DCS-900 DCS-2000 and DCS-5300 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the rootpass parameter.


Cross-site

request

forgery

(CSRF)

vulnerability

in

in

CMS

Made

Simple

(CMSMS)

and

earlier

allows

remote

attackers

to

hijack

the

authentication

of

administrators

for

requests

that

delete

arbitrary

files

via

the

deld

parameter.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

IBM

TRIRIGA

Application

Platform

and

before

and

allow

remote

attackers

to

hijack

the

authentication

of

arbitrary

users

for

requests

that

modify

data

records

via

vectors

involving

the

html/en/default/

directory

or


Multiple cross-site request forgery (CSRF) vulnerabilities in the RESTful Web Services (RESTWS) module 7.x-1.x before 7.x-1.1 and 7.x-2.x before 7.x-2.0-alpha3 for Drupal allow remote attackers to hijack the authentication of arbitrary users via unknown vectors.


Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php as demonstrated by a developer name containing XSS sequences.


Cross-site request forgery (CSRF) vulnerability in servlet/traveler in IBM Lotus Notes Traveler through 8.5.3.3 Interim Fix 1 allows remote attackers to hijack the authentication of arbitrary users for requests that create problem reports via a getReportProblem upload action.


Cross-site request forgery (CSRF) vulnerability on HP ProCurve 1700-8 (aka J9079A) switches with software before VA.02.09 and 1700-24 (aka J9080A) switches with software before VB.02.09 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.


Cross-site request forgery (CSRF) vulnerability in the Commerce Extra Panes module 7.x-1.x before 7.x-1.1 in Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable a Commerce extra panes pane via unspecified vectors related to \the link to reorder items.\


Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via screens/aaa/mgmtuser_create.html or (2) insert XSS sequences via the headline parameter to screens/base/web_auth_custom.html aka Bug ID CSCud50283.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

Parallels

H-Sphere

Patch

allow

remote

attackers

to

hijack

the

authentication

of

admins

for

requests

that

add

group

plans

via

or

add

extra

packages

via


Cross-site

request

forgery

(CSRF)

vulnerability

in

webconfig/admin_passwd/passwd.html/admin_passwd

in

Xavi

allows

remote

attackers

to

hijack

the

authentication

of

administrators

for

requests

that

change

the

administrator

password

via

the

sysUserName

sysPassword

and

sysCfmPwd

parameters.


Cross-site request forgery (CSRF) vulnerability in the CentralAuth extension for MediaWiki before 1.19.9 1.20.x before 1.20.8 and 1.21.x before 1.21.3 allows remote attackers to hijack the authentication of users for requests that login via vectors involving image loading.


Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an add action (2) change user passwords via a change action or (3) delete a user via a delete action.


The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited this cross-site request forgery (CSRF) vulnerability could allow attackers to force NAS users to execute unintentional actions through a web application. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.


DISPUTED

Cross-site

request

forgery

(CSRF)

vulnerability

in

in

OpenCMS

allows

remote

attackers

to

hijack

the

authentication

of

administrative

users

for

requests

that

perform

privilege

escalation.

Note:

It

is

argued

that

OpenCMS

allows

only

registered

users

to

upload

different

kind

of

content

artifacts

(SVG

.doc

.docx).

The

uploaded

content

is

stored

in

the

CMS

content

repository

\as

is\.

In

case

of

scripts

inside

an

SVG

this

may

or

may

not

be

\malicious\

there

is

no

way

of

knowing

if

the

uploaded

SVG

contains

the

script

for

a

reason.

To

exploit

the

\issue\

a

user

must

have

an

account

in

the

CMS

as

a

content

manager.


Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the (1) username (2) password (3) admin (4) action (5) uid or (6) modify_admin parameter.


PHP Scripts Mall Advance B2B Script 2.1.4 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.


PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature.


The administrative daemon (tibdgadmind) of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition TIBCO ActiveSpaces - Developer Edition and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: 3.3.0; 3.4.0; 3.5.0 TIBCO ActiveSpaces - Developer Edition: 3.0.0; 3.1.0; 3.3.0; 3.4.0; 3.5.0 and TIBCO ActiveSpaces - Enterprise Edition: 3.0.0; 3.1.0; 3.2.0; 3.3.0; 3.4.0; 3.5.0.


The Central Administration server (emsca) component of TIBCO Software Inc.'s TIBCO Enterprise Message Service TIBCO Enterprise Message Service - Community Edition and TIBCO Enterprise Message Service - Developer Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Message Service: versions 8.4.0 and below TIBCO Enterprise Message Service - Community Edition: versions 8.4.0 and below and TIBCO Enterprise Message Service - Developer Edition: versions 8.4.0 and below.


NPAPI plugins such as Adobe Flash can send non-simple cross-origin requests bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery (CSRF) attacks. This vulnerability affects Thunderbird < 60 Thunderbird < 52.9 Firefox ESR < 60.1 Firefox ESR < 52.9 and Firefox < 61.


The Rendezvous Routing Daemon (rvrd) Rendezvous Secure Routing Daemon (rvrsd) Rendezvous Secure Daemon (rvsd) Rendezvous Cache (rvcache) and Rendezvous Daemon Manager (rvdm) components of TIBCO Software Inc.'s TIBCO Rendezvous TIBCO Rendezvous Developer Edition TIBCO Rendezvous for z/Linux TIBCO Rendezvous for z/OS TIBCO Rendezvous Network Server TIBCO Substation ES contain vulnerabilities which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Rendezvous: versions up to and including 8.4.5 TIBCO Rendezvous Developer Edition: versions up to and including 8.4.5 TIBCO Rendezvous for z/Linux: versions up to and including 8.4.5 TIBCO Rendezvous for z/OS: versions up to and including 8.4.5 TIBCO Rendezvous Network Server: versions up to and including 1.1.2 and TIBCO Substation ES: versions up to and including 2.12.2.


The realm server (tibrealmserver) component of TIBCO Software Inc. TIBCO FTL - Community Edition TIBCO FTL - Developer Edition and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc. TIBCO FTL - Community Edition: versions up to and including 5.4.0 TIBCO FTL - Developer Edition: versions up to and including 5.4.0 TIBCO FTL - Enterprise Edition: versions up to and including 5.4.0.


The GridServer Broker and GridServer Director components of TIBCO Software Inc.'s TIBCO DataSynapse GridServer Manager contain vulnerabilities which may allow an unauthenticated user to perform cross-site request forgery (CSRF). Affected releases are TIBCO Software Inc. TIBCO DataSynapse GridServer Manager: versions up to and including 5.2.0; 6.0.0; 6.0.1; 6.0.2; 6.1.0; 6.1.1; 6.2.0; 6.3.0.


The Schema repository server (tibschemad) component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc. TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition: 1.0.0 and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition: 1.0.0.


The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6 the bundled version of Confluence Questions was updated to a fixed version in Confluence version 6.9.0 allows remote attackers to modify a comment into an answer via a Cross-site request forgery (CSRF) vulnerability.


Many resources in Atlassian Jira before version 7.6.9 from version 7.7.0 before version 7.7.5 from version 7.8.0 before version 7.8.5 from version 7.9.0 before version 7.9.3 from version 7.10.0 before version 7.10.3 from version 7.11.0 before version 7.11.3 from version 7.12.0 before version 7.12.3 and before version 7.13.1 allow remote attackers to attack users in some cases be able to obtain a user's Cross-site request forgery (CSRF) token via a open redirect vulnerability.


A vulnerability has been identified in SIMATIC S7-1200 CPU family version 4 (All versions < V4.2.3). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user who must be authenticated to the web interface. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. This could allow the attacker to read or modify parts of the device configuration.


A vulnerability has been identified in CP 1604 (All versions) CP 1616 (All versions). The integrated configuration web server of the affected CP devices could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. At the time of advisory publication no public exploitation of this vulnerability was known.


The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6 the bundled version of Confluence Questions was updated to a fixed version in Confluence version 6.9.0 allows remote attackers to modify a comment into an answer via a Cross-site request forgery (CSRF) vulnerability.


The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.


The XsrfErrorAction resource in Atlassian Jira before version 7.6.9 from version 7.7.0 before version 7.7.5 from version 7.8.0 before version 7.8.5 from version 7.9.0 before version 7.9.3 from version 7.10.0 before version 7.10.3 from version 7.11.0 before version 7.11.3 from version 7.12.0 before version 7.12.3 and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability.


IBM Cram Social Program Management 6.1.1 6.2.0 7.0.4 and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154891.


A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (formerly CUPS) could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvi55878.


A vulnerability in the web-based management interface of Cisco Tetration Analytics could allow an authenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.


A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to improper CSRF protection by the affected application. An attacker could exploit this vulnerability by persuading a user of the affected application to click a malicious link. A successful exploit could allow the attacker to submit arbitrary requests and take unauthorized actions on behalf of the user. Cisco Bug IDs: CSCvg45114.


A vulnerability in the device manager web interface of Cisco Industrial Ethernet Switches could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected system. The vulnerability is due to insufficient CSRF protection by the device manager web interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link or visit an attacker-controlled website. A successful exploit could allow the attacker to submit arbitrary requests to an affected device via the device manager web interface with the privileges of the user. This vulnerability affects the following Cisco Industrial Ethernet (IE) Switches if they are running a vulnerable release of Cisco IOS Software: IE 2000 Series IE 2000U Series IE 3000 Series IE 3010 Series IE 4000 Series IE 4010 Series IE 5000 Series. Cisco Bug IDs: CSCvc96405.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvf69805.


A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and alter the data of existing users and groups on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the user has administrative privileges the attacker could create a new privileged account to obtain full control over the device interface. This vulnerability affects Connected Grid Network Management System if running a software release prior to IoT-FND Release 3.0; and IoT Field Network Director if running a software release prior to IoT-FND Release 4.1.1-6 or 4.2.0-123. Cisco Bug IDs: CSCvi02448.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvi85159.


A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvh31222.


A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvi44320.


A vulnerability in the web-based management interface of Cisco Industrial Network Director could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious customized link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device via a web browser and with the privileges of the user.


A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections on the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvg88291.


A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) Supervisor Software could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protection by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions via the user's web browser and with the user's privileges on an affected system. Cisco Bug IDs: CSCvf71929.


A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections on the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCuv32863.


A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this vulnerability by tricking the user of a web application into executing an adverse action. Cisco Bug IDs: CSCvg30313.


A vulnerability in the web-based management interface of Cisco Meeting Server could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.


A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions on the targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvb19750.


An

issue

was

discovered

in

the

MULTIDOTS

Woo

Checkout

for

Digital

Goods

plugin

for

WordPress.

If

an

admin

user

can

be

tricked

into

visiting

a

crafted

URL

created

by

an

attacker

(via

spear

phishing/social

engineering)

the

attacker

can

change

the

plugin

settings.

The

function

in

the

file

class-woo-checkout-for-digital-goods-admin.php

doesn't

do

any

check

against

wp-admin/admin-post.php

Cross-site

request

forgery

(CSRF)

and

user

capabilities.


An

issue

was

discovered

in

YXcms

Cross-site

request

forgery

(CSRF)

vulnerability

in

allows

remote

attackers

to

delete

administrator

accounts

via

index.php?r=admin/admin/admindel.


An issue was discovered in CScms v4.1. A Cross-site request forgery (CSRF) vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the administrator's username and password via /admin.php/sys/editpass_save.


A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by an legitimate user who must be authenticated to the web interface as administrative user. A successful attack could allow an attacker to interact with the web interface as an administrative user. This could allow the attacker to read or modify the device configuration or to exploit other vulnerabilities that require authentication as administrative user. At the time of advisory publication no public exploitation of this security vulnerability was known.


An

issue

was

discovered

in

PbootCMS

Cross-site

request

forgery

(CSRF)

vulnerability

in

allows

remote

attackers

to

add

administrator

accounts

via


An

issue

was

discovered

in

SDcms

Cross-site

request

forgery

(CSRF)

vulnerability

in

allows

remote

attackers

to

add

administrator

accounts

via

m=admin&c=admin&a=add.


Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. An attacker could exploit this by tricking already authenticated users into visiting a malicious site and hijacking the authtoken cookie.


qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A malicious website could exploit this to load a 'qute://settings/set' URL which then sets 'editor.command' to a bash script resulting in arbitrary code execution.


Cross-site request forgery (CSRF) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to hijack the authentication of authenticated users for requests that can obtain sensitive information via unspecified vectors.


IBM SAN Volume Controller IBM Storwize IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1 6.2 6.3 6.4 7.1 7.2 7.3 7.4 7.5 7.6 7.6.1 7.7 7.7.1 7.8 7.8.1 8.1 and 8.1.1) are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 139474.


IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 148944.


IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.4) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 139598.


IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 144348.


IBM InfoSphere Information Server 9.1 11.3 11.5 and 11.7 is vulnerable to cross-frame scripting which is a vulnerability that allows an attacker to load Information Server components inside an HTML iframe tag on a malicious page. The attacker could use this weakness to devise a Clickjacking attack to conduct phishing frame sniffing social engineering or Cross-Site Request Forgery attacks. IBM X-Force ID: 139360.


IBM StoredIQ 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 153118.


Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1 8.0.1.0 - 8.0.1.2 and 8.0.0.0 - 8.0.0.6 versions 7.2.1.x and version 7.1.1.11 and 8.1.0.2 is affected by a cross-site request forgery vulnerability. A malicious user may potentially exploit this vulnerability to send unauthorized requests to the server on behalf of authenticated users of the application.


IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 11029.


A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.


Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the \Settings > Users / Roles\ function.


NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. A cross-site request forgery condition can occur allowing an attacker to change passwords of the device remotely.


Missing protections against Cross-Site Request Forgery in the web application in ZyXEL NSA325 V2 version 4.81 allow attackers to perform state-changing actions via crafted HTTP forms.


An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A Cross-site request forgery (CSRF) vulnerability allows remote attackers to hijack the authentication of users for requests that modify all the settings. This vulnerability can lead to changing an existing user's username and password changing the Wi-Fi password etc.


ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) on /CWEBNET/* authenticated pages. A successful CSRF attack can force the user to modify state: creating users changing an email address and so forth. If the victim is an administrative account CSRF can compromise the entire web application.


An exploitable cross-site request forgery vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause an authenticated user to perform privileged requests unknowingly resulting in unauthenticated requests being requested through an authenticated user. An attacker can get an authenticated user to request authenticated pages on the attacker's behalf to trigger this vulnerability.


An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection it is possible to automate the action of sending private messages to users by luring an authenticated user to a web page that automatically submits a form on their behalf.


A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system via a web browser and with the privileges of the user.


A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to use a web browser to perform arbitrary actions with the privileges of the user on an affected system.


A vulnerability in the web-based management interface of Cisco Energy Management Suite Software could allow an authenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user.


A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated remote attacker to conduct cross-site request forgery (CSRF) attacks. The vulnerability is due to improper validation of Origin headers on HTTP requests within the management interface. An attacker could exploit this vulnerability by convincing a targeted user to follow a URL to a malicious website. An exploit could allow the attacker to take actions within the software with the privileges of the targeted user or gain access to sensitive information.


Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm.


A potential Cross-Site Request Forgery (CSRF) vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Cross-Site Request Forgery (CSRF).


Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1.


Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentication of users for requests that (1) change user settings (2) send emails or (3) change contact information by leveraging lack of an anti-CSRF token.


Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10 4.11 4.12 4.13 4.14 4.15 4.15.1 which could allow for remote unsafe deserialization and cross-site request forgery (CSRF).


A lack of cross-site request forgery (CSRF) protection vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to submit authenticated requests to a user browsing an attacker-controlled domain.


Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Server version DDM Content Pack V 10.20 10.21 10.22 10.22 CUP7 10.30 10.31 10.32 10.33 10.33 CUP2 11.0 and CMS Server version 2018.05 BACKGROUND which could allow for remote unsafe deserialization and cross-site request forgery (CSRF).


Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal allows remote authenticated users to hijack the authentication of application users for requests that modify their personal data by leveraging lack of anti-CSRF tokens.


Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) delete e-mail messages via a delete action in a request to secmail/getmessage.exe or (2) spoof arbitrary users and reply to their messages via a request to secserver/securectrl.exe.


OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super as demonstrated by use of interface/super/manage_site_files.php to upload a .php file.


The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. The impact is sensitive actions in the portal (such as changing a portal user's password). NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments (2) restoring a deleted user (3) installing or running modules (4) resetting the analytics (5) pinging the mailmotor api (6) uploading things to the media library (7) exporting locale.


Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data Password parameter.


EC Cloud E-Commerce System v1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add admin accounts via /admin.html?do=user&act=add.


emlog v6.0 contains a Cross-Site Request Forgery (CSRF) via /admin/link.php?action=addlink which allows attackers to arbitrarily add articles.


iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.


Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace /list_users /list_byod?usertype=raduser /dhcp_leases /go?rid=202 in which a specially crafted HTTP request may reconfigure the device.


The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog.


BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor' as demonstrated by use of 'mode=settings&page=editor' to change any file content (Locally/Remotely).


We have recently released new version of AirMax AirOS firmware v6.3.0 for TI XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI XW and XM boards according to the description below:Attackers can abuse multiple end-points not protected against cross-site request forgery (CSRF) as a result authenticated users can be persuaded to visit malicious web pages which allows attackers to perform arbitrary actions such as downgrade the device's firmware to older versions modify configuration upload arbitrary firmware exfiltrate files and tokens.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.


Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks as demonstrated by changing a user's role.


A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue an unauthenticated attacker can change the newSSID and hostapd_wpa_passphrase.


Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF). If an authenticated user visits a malicious page unintended actions could be performed in the web application as the authenticated user.


Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability which could allow an attacker to modify policy rules by tricking an authenticated administrator into accessing an attacker-controlled web page. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.


A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 (All Versions) Modicon Quantum CPUs with integrated Ethernet (Copro): 140CPU65 (All Versions) Modicon Premium CPUs with integrated Ethernet (Copro): TSXP57 (All Versions) Modicon M340 ethernet modules: (BMXNOC0401 BMXNOE01 BMXNOR0200H) (All Versions) Modicon Quantum and Premium factory cast communication modules: (140NOE77111 140NOC78*00 TSXETY5103 TSXETY4103) (All Versions)


A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to execute malicious commands on behalf of a legitimate user when xsrf-token data is intercepted.


A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x 7.1 and 7.1 SP1.


It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight checks are not instigated or bypassed. For example authorised users using an older browser with Adobe Flash are vulnerable when targeted by an attacker. This flaw affects all versions of AMQ-Online prior to 1.5.2 and Enmasse versions 0.31.0-rc1 up until but not including 0.32.2.


WebFOCUS Business Intelligence 8.0 (SP6) allows a Cross-Site Request Forgery (CSRF) attack against administrative users within the /ibi_apps/WFServlet(.ibfs) endpoint. The impact may be creation of an administrative user. It can also be exploited in conjunction with CVE-2016-9044.


Cross-site request forgery (CSRF) vulnerability in NETGEAR switching hubs (GS716Tv2 Firmware version 5.4.2.30 and earlier and GS724Tv3 Firmware version 5.4.2.30 and earlier) allow remote attackers to hijack the authentication of administrators and alter the settings of the device via unspecified vectors.


In BIG-IP versions 15.0.0-15.1.0.3 14.1.0-14.1.2.5 13.1.0-13.1.3.3 12.1.0-12.1.5.1 a cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface (TMUI) also referred to as the Configuration utility exists in an undisclosed page.


RSA Archer versions prior to 6.7 P2 (6.7.0.2) contain a cross-site request forgery vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to send arbitrary requests to the vulnerable application to perform server operations with the privileges of the authenticated victim user.


Cross-site request forgery (CSRF) vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7) Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7) Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7) Movable Type 6.5.3 and earlier (Movable Type 6.5) Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced 6.5) Movable Type 6.3.11 and earlier (Movable Type 6.3) Movable Type Advanced 6.3.11 and earlier (Movable Type 6.3) Movable Type Premium 1.29 and earlier and Movable Type Premium Advanced 1.29 and earlier) allows remote attackers to hijack the authentication of administrators via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier allows remote attackers to hijack the authentication of administrators and the product's settings may be changed without the user's intention or consent via unspecified vectors.


IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 175410.


A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10 which is an attack that forces a user to execute unwanted actions on the web application while they are currently authenticated. This applies to a single server class only with no impact to remainder of web application. IBM X-Force ID: 189151.


IBM Maximo Spatial Asset Management 7.6.0.3 7.6.0.4 7.6.0.5 and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186024.


IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 6.1.0.0 through 6.1.0.3 and 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186283.


IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 189841.


IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 188898.


IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 175411.


IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 174910.


IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 189840.


IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191815.


The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability.


A vulnerability has been identified in Polarion Subversion Webclient (All versions). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user who must be authenticated to the web interface. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. This could allow the attacker to read or modify contents of the web application.


iBall WRD12EN 1.0.0 devices allow cross-site request forgery (CSRF) attacks as demonstrated by enabling DNS settings or modifying the range for IP addresses.


TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These action include allowing attackers to submit their own code through an authenticated user resulting in local file Inclusion. If an authenticated user who is able to edit TikiWiki templates visits an malicious website template code can be edited.


OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly verify whether a request made to the application was intentionally made by the user allowing for cross-site request forgery attacks on all user functions.


A Cross-Site Request Forgery (CSRF) vulnerability exists in Star Practice Management Web version 2019.2.0.6 allowing an attacker to change the privileges of any user of the application. This can be used to grant himself administrative role or remove the administrative account of the application.


FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.


Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of administrators and to perform actions on the Expedition Migration Tool. This issue affects Expedition Migration Tool 1.1.51 and earlier versions.


A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link while having an active session on an affected device. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user.


A vulnerability in the web-based management interface of Cisco Unified Communications Manager (UCM) could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user.


A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an unauthenticated remote attacker to access the back-end database of an affected system. The vulnerability exists because the affected software does not properly authenticate REST API calls. An attacker could exploit this vulnerability by obtaining a cross-site request forgery (CSRF) token and then using the token with REST API requests. A successful exploit could allow the attacker to access the back-end database of the affected device and read alter or drop information.


A vulnerability in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections by the affected software. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could change the password of a targeted user. An attacker could then take unauthorized actions on behalf of the targeted user.


A vulnerability in the web-based management interface of Cisco Mobility Express Software could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user with an active session on an affected device to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions including modifying the configuration with the privilege level of the user.


A vulnerability in the web-based interface of Cisco Prime Network Registrar (CPNR) could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections in the web-based interface. An attacker could exploit this vulnerability by persuading a targeted user with an active administrative session on the affected device to click a malicious link. A successful exploit could allow an attacker to change the device's configuration which could include the ability to edit or create user accounts of any privilege level. Some changes to the device's configuration could negatively impact the availability of networking services for other devices on networks managed by CPNR.


A vulnerability in the Cisco Firepower Chassis Manager (FCM) of Cisco FXOS Software could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected device. The vulnerability is due to insufficient CSRF protections for the FCM interface. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could take unauthorized actions on behalf of the targeted user.


Combodo iTop contains a cross-site request forgery (CSRF) vulnerability attackers can execute specific commands via malicious site request forgery.


Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface.


An exploitable SQL injection vulnerability exists in the \access_rules/rules_form\ page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability this can be done either with administrator credentials or through cross-site request forgery.


A

cross-site

request

forgery

vulnerability

exists

in

the

GACL

functionality

of

OpenEMR

and

development

version

(commit

A

specially

crafted

HTTP

request

can

lead

to

the

execution

of

arbitrary

requests

in

the

context

of

the

victim.

An

attacker

can

send

an

HTTP

request

to

trigger

this

vulnerability.


Multiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities this can be done either with administrator credentials or through cross-site request forgery.


The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents allowing the possibility of deleting records (users) when an ID is known.


A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. This could be exploited in conjunction with CVE-2020-13260.


An exploitable SQL injection vulnerability exists in \global_lists/choices\ page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability this can be done either with administrator credentials or through cross-site request forgery.


The QuickEdit module does not properly validate access to routes which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the \access in-place editing\ permission from untrusted users will not fully mitigate the vulnerability.


An exploitable SQL injection vulnerability exists in the \forms_fields_rules/rules\ page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability this can be done either with administrator credentials or through cross-site request forgery.


A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials.


A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method potentially capturing credentials stored in Jenkins.


A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method capturing credentials stored in Jenkins.


IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 121314.


IBM InfoSphere Master Data Management Server 10.1 11.0 11.3 11.4 11.5 and 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 119727.


Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: `www/admin/banner-acl.php` `www/admin/banner-activate.php` `www/admin/banner-advanced.php` `www/admin/banner-modify.php` `www/admin/banner-swf.php` `www/admin/banner-zone.php` `www/admin/tracker-modify.php`.


IBM QRadar Incident Forensics 7.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 1999549.


Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This vulnerability could be exploited to send a large number of password recovery emails to the registered users especially in conjunction with a bug that caused recovery emails to be sent to all the users at once. Both issues have been fixed.


Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts in order to identify and fix other potential CSRF vulnerabilities. Over 20+ such issues were fixed.


IBM InfoSphere Master Data Management Server 11.0 11.3 11.4 11.5 and 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 119729.


An issue was discovered in Moxa NPort 5110 versions prior to 2.6 NPort 5130/5150 Series versions prior to 3.6 NPort 5200 Series versions prior to 2.8 NPort 5400 Series versions prior to 3.11 NPort 5600 Series versions prior to 3.7 NPort 5100A Series & NPort P5150A versions prior to 1.3 NPort 5200A Series versions prior to 1.3 NPort 5150AI-M12 Series versions prior to 1.2 NPort 5250AI-M12 Series versions prior to 1.2 NPort 5450AI-M12 Series versions prior to 1.2 NPort 5600-8-DT Series versions prior to 2.4 NPort 5600-8-DTL Series versions prior to 2.4 NPort 6x50 Series versions prior to 1.13.11 NPort IA5450A versions prior to v1.4. Requests are not verified to be intentionally submitted by the proper user (CROSS-SITE REQUEST FORGERY).


An issue was discovered in Moxa ioLogik E1210 firmware Version V2.4 and prior ioLogik E1211 firmware Version V2.3 and prior ioLogik E1212 firmware Version V2.4 and prior ioLogik E1213 firmware Version V2.5 and prior ioLogik E1214 firmware Version V2.4 and prior ioLogik E1240 firmware Version V2.3 and prior ioLogik E1241 firmware Version V2.4 and prior ioLogik E1242 firmware Version V2.4 and prior ioLogik E1260 firmware Version V2.4 and prior ioLogik E1262 firmware Version V2.4 and prior ioLogik E2210 firmware versions prior to V3.13 ioLogik E2212 firmware versions prior to V3.14 ioLogik E2214 firmware versions prior to V3.12 ioLogik E2240 firmware versions prior to V3.12 ioLogik E2242 firmware versions prior to V3.12 ioLogik E2260 firmware versions prior to V3.13 and ioLogik E2262 firmware versions prior to V3.12. The web application may not sufficiently verify whether a request was provided by a valid user (CROSS-SITE REQUEST FORGERY).


An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application does not sufficiently verify if a request was intentionally provided by the user who submitted the request (CROSS-SITE REQUEST FORGERY).


In Apache Brooklyn before 0.10.0 the REST server is vulnerable to cross-site request forgery (CSRF) which could permit a malicious web site to produce a link which if clicked whilst a user is logged in to Brooklyn would cause the server to execute the attacker's commands as the user. There is known to be a proof-of-concept exploit using this vulnerability.


An exploitable Cross-Site Request Forgery vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted form can trick a client into making an unintentional request to the web server which will be treated as an authentic request.


IBM Tivoli Storage Productivity Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.


IBM Sterling Order Management 9.2 - 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 2000943.


Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider_xml request. NOTE: this issue can be combined with CVE-2016-7998 to execute arbitrary PHP code.


The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings which makes easier for remote attackers to (1) bypass CSRF protection mechanisms or (2) conduct cross-site request forgery (CSRF) attacks by obtaining an old token.


csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===` a fail first string comparison instead of a time constant string comparison This enables an attacker to guess the secret in no more than (16*18)288 guesses instead of the 16^18 guesses required were the timing attack not present.


Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.


rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and as a result an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.


The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus as demonstrated by resultant width XSS.


A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvb06663. Known Affected Releases: 11.5(1.10000.4). Known Fixed Releases: 12.0(0.98000.14).


Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7 3.x before 3.3.0.5 and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40 1.7.x before 1.7.21 and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope via a profile or authorize approval page.


Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1) as used in Unified Contact Center Express 10.0(1) through 11.0(1) allows remote attackers to hijack the authentication of arbitrary users aka Bug IDs CSCuy75036 and CSCuy81654.


Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7 1.5.10 and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function a related issue to CVE-2016-6896.


Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option as demonstrated by gaining access to the credentials of a victim's account.


Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6 2.6.x before 2.6.6 2.8.x before 2.8.3 2.10.x before 2.10.4 2.12.x before 2.12.4 and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.


A cross-site request forgery (CSRF) vulnerability in the web interface of the Cisco Hosted Collaboration Mediation Fulfillment application could allow an unauthenticated remote attacker to execute unwanted actions. More Information: CSCva54241. Known Affected Releases: 11.5(1). Known Fixed Releases: 11.5(0.98000.216).


IBM Tivoli Storage Manager for Virtual Environments 7.1 (VMware) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 1995545.


IBM Disposal and Governance Management for IT and IBM Global Retention Policy and Schedule Management components of IBM Atlas Policy Suite 6.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 2000771.


A vulnerability in Cisco Finesse Agent and Supervisor Desktop Software could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface. More Information: CSCvb57213. Known Affected Releases: 11.0(1).


Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.


Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allow remote attackers to hijack the authentication of administrators for requests that (1) restore factory settings or (2) reboot the device via unspecified vectors.


CodeLathe FileCloud version 13.0.0.32841 and earlier contains a global cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user provided the victim has an active session and is induced to trigger the malicious request.


Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.


Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE HVL-A2.0 HVL-A3.0 HVL-A4.0 HVL-AT1.0S HVL-AT2.0 HVL-AT3.0 HVL-AT4.0 HVL-AT2.0A HVL-AT3.0A and HVL-AT4.0A devices with firmware before 2.04 allows remote attackers to hijack the authentication of arbitrary users for requests that delete content.


Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests via an entitlement/eval-policy-submit.jsp request.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

Apache

Archiva

and

earlier

allow

remote

attackers

to

hijack

the

authentication

of

administrators

for

requests

that

add

new

repository

proxy

connectors

via

the

token

parameter

to

new

repositories

via

the

token

parameter

to

edit

existing

repositories

via

the

token

parameter

to

add

legacy

artifact

paths

via

the

token

parameter

to

admin/addLegacyArtifactPath_commit.action

change

the

organizational

appearance

via

the

token

parameter

to

admin/saveAppearance.action

or

upload

new

artifacts

via

the

token

parameter

to


A Cross-site Request Forgery issue was discovered in JanTek JTC-200 all versions. An attacker could perform actions with the same permissions as a victim user provided the victim has an active session and is induced to trigger the malicious request.


IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.


Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier WEX-300 devices with firmware 1.90 and earlier WHR-1166DHP devices with firmware 1.90 and earlier WHR-300HP2 devices with firmware 1.90 and earlier WHR-600D devices with firmware 1.90 and earlier WMR-300 devices with firmware 1.90 and earlier WMR-433 devices with firmware 1.01 and earlier and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to hijack the authentication of arbitrary users.


Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators as demonstrated by reconfiguring time settings via a vaconfig/time request.


Cross-site request forgery (CSRF) vulnerability on NTT EAST Hikari Denwa routers with firmware PR-400MI RT-400MI and RV-440MI 07.00.1006 and earlier and NTT WEST Hikari Denwa routers with firmware PR-400MI RT-400MI and RV-440MI 07.00.1005 and earlier allows remote attackers to hijack the authentication of arbitrary users.


IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room to cause the screen sharing to cease through the use of cross-site request forgery. IBM X-Force ID: 111894.


Cross-site request forgery (CSRF) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors. IBM X-Force ID: 111052.


Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors. IBM X-Force ID: 111736.


Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6 3.4 before 3.4.2.4 and 3.5 before 3.5.0.2 allows remote authenticated users to hijack the authentication of administrators for requests that delete employees.


IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room to cause the screen sharing to cease through the use of cross-site request forgery. IBM X-Force ID: 111895.


Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file.


Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 7.0 Feature Pack 8 8.0.0.x before 8.0.0.10 and 8.0.1.x before 8.0.1.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.


Cross-site request forgery (CSRF) vulnerability on Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714 MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714 MiiNePort_E2_1242 devices with firmware 1.1 Build 10080614 MiiNePort_E2_4561 devices with firmware 1.1 Build 10080614 and MiiNePort E3 devices with firmware 1.0 Build 11071409 allows remote attackers to hijack the authentication of arbitrary users.


Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11 2.7.x before 2.7.13 2.8.x before 2.8.11 2.9.x before 2.9.5 and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Organizations and Remediation management page in Enterprise Manager in McAfee Vulnerability Manager (MVM) before 7.5.10 allow remote attackers to hijack the authentication of administrators for requests that have unspecified impact via unknown vectors.


Cross-site request forgery (CSRF) vulnerability in the PA_Theme_Creator application in IBM WebSphere Portal 8.5 CF08 through CF10 and Web Content Manager allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.


Cross-site request forgery (CSRF) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1 in an unspecified non-default configuration allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.


Cross-site request forgery (CSRF) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 6.0 and 6.0.1 before 6.0.1 ifix005 and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrary users.


Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3 2.9 through 2.9.5 2.8 through 2.8.11 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that (1) add (2) modify or (3) remove accounts by leveraging failure to use of a CSRF token and perform referer header checks aka bugs 100885 and 100899.


Multiple cross-site request forgery (CSRF) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the Client uploader extension or (2) extension REST handlers aka bugs 104294 and 104456.


Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4 4.5 through CR5 and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the Connections generic page.


Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4 4.5 through CR5 and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the set of available applications.


Cross-site request forgery (CSRF) vulnerability in the management interface for VMware ESX Server 2.0.x before 2.0.2 patch 1 2.1.x before 2.1.3 patch 1 and 2.x before 2.5.3 patch 2 allows allows remote attackers to perform unauthorized actions as the administrator via URLs as demonstrated using the setUsr operation to change a password. NOTE: this issue can be leveraged with CVE-2005-3619 to automatically perform the attacks.


Multiple cross-site request forgery (CSRF) vulnerabilities in (1) addaddress.php (2) toggleignore.php (3) removeignore.php and (4) removeaddress.php in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to modify settings as another user via a link or IMG tag.


Multiple cross-site request forgery (CSRF) vulnerabilities in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allow remote attackers to perform unauthorized actions as a logged-in user as demonstrated by tricking the administrator to access a web page that performs a mod_info action in modify_gallery.php.


Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.7.0 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag to server_privileges.php as demonstrated using the dbname and checkprivs parameters. NOTE: the provenance of this issue is unknown although third parties imply that it is related to the disclosure of CVE-2005-4349 which was labeled as SQL injection but disputed.


Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5 MetaFrame Presentation Server 3.0 and Access Essentials 1.0 through 2.0 allows remote attackers to execute arbitrary published applications and possibly other programs as authenticated users via the InitialProgram key in an ICA connection. NOTE: some of these details are obtained from third party information.


Cross-site request forgery (CSRF) vulnerability in I-O DATA DEVICE HDL-F160 HDL-F250 HDL-F300 and HDL-F320 firmware before 1.02 allows remote attackers to (1) change a configuration or (2) delete files as an authenticated user via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4 7.0 and 7.1 allows remote attackers to hijack the authentication of administrators for requests that update the password via idm/admin/changeself.jsp.


Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process and trigger execution of arbitrary programs by this process via unspecified HTTP requests.


Cross-site request forgery (CSRF) vulnerability in the Special:Import feature in MediaWiki 1.3.0 through 1.6.10 1.12.x before 1.12.2 and 1.13.x before 1.13.3 allows remote attackers to perform unspecified actions as authenticated users via unknown vectors.


Multiple cross-site request forgery (CSRF) vulnerabilities in mvnForum before 1.2.1 GA allow remote attackers to (1) create forums (2) change account privileges (3) enable accounts or (4) disable accounts as a product administrator via unspecified vectors possibly related to HTTP Referer headers.


Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to perform unauthorized actions as administrators via a request that sets the wpcr_hidden_form_input parameter.


Cross-site request forgery (CSRF) vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to perform unauthorized actions as an administrator including file deletion and creation via a link or IMG tag to the (1) overkill (2) futils or (3) edit actions.


ftpd in OpenBSD 4.3 FreeBSD 7.0 NetBSD 4.0 Solaris and possibly other operating systems interprets long commands from an FTP client as multiple commands which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.


ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.


Cross-site request forgery (CSRF) vulnerability in index.tmpl in Vuze (formerly Azureus HTML WebUI) probably 0.7.6 allows remote attackers to hijack the authentication of users for requests that force the download of arbitrary torrent files via the upurl parameter.


Multiple cross-site request forgery (CSRF) vulnerabilities in password.php in PHPmotion 2.1 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that modify an account via the (1) password or (2) email_address parameter.


Cross-site request forgery (CSRF) vulnerability in multiple Century Systems routers including XR-410 before 1.6.9 XR-510 before 3.5.3 XR-440 before 1.7.8 and other XR series routers from XR-510 to XR-730 allows remote attackers to modify configuration as the administrator via unknown vectors.


Cross-site request forgery (CSRF) vulnerability in the file manager in the VZPP web interface for Parallels Virtuozzo 365.6.swsoft (build 4.0.0-365.6.swsoft) and 25.4.swsoft (build 3.0.0-25.4.swsoft) allows remote attackers to create and delete arbitrary files as the administrator via a link or IMG tag to (1) create-file and (2) list-control in vz/cp/vzdir/infrman/envs/files/; or modify system configuration via the path parameter to vz/cp/vzdir/infrman/envs/files/index.


Multiple cross-site request forgery (CSRF) vulnerabilities in Collabtive 0.4.8 allow remote attackers to hijack the authentication of administrators for requests that (1) submit or edit a new project or (2) upload files to a project or (3) attach files to messages via unknown vectors. NOTE: these issues can be leveraged with other vulnerabilities to create remote attack vectors that do not require authentication.


Cross-site request forgery (CSRF) vulnerability in Atlassian JIRA Enterprise Edition 3.13 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors as demonstrated by causing the superuser to \execute old updates\ that modify the database.


Cross-site request forgery (CSRF) vulnerability in index.php in BabbleBoard 1.1.6 allows remote authenticated users to hijack the authentication of administrators for requests that delete (1) categories or (2) groups; (3) ban users; or (4) delete users via the admin page.


Cross-site request forgery (CSRF) vulnerability in IBM Workplace for Business Controls and Reporting 2.x and IBM Workplace Web Content Management 6.x has unknown impact and remote attack vectors. NOTE: some of these details are obtained from third party information.


Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify the network configuration via certain parameters to goform/formWanTcpipSetup or (2) modify credentials via certain parameters to goform/formPasswordSetup.


Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action.


Cross-site request forgery (CSRF) vulnerability in the Localization client 5.x before 5.x-1.1 and 6.x before 6.x-1.6 and the Localization server 5.x before 5.x-1.0-alpha5 and 6.x before 6.x-alpha2 modules for Drupal allows remote attackers to perform unauthorized actions as administrators via unspecified vectors related to the \local translation submission interface.\


Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection as demonstrated using text/plain.


Web Management Console Cross-site request forgery (CSRF) vulnerability in the web management console in F5 BIG-IP 9.4.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrators and execute shell commands as demonstrated using tmui/Control/form.


Cross-site request forgery (CSRF) vulnerability in index.php in WoltLab Burning Board (wBB) 3.0.1 and possibly other 3.x versions allows remote attackers to hijack the authentication of users for requests that delete private messages via the pmID parameter in a delete action in a PM page a different vulnerability than CVE-2008-0472.


PHPKIT 1.6.4 PL1 includes the session ID in the URL which allows remote attackers to conduct cross-site request forgery (CSRF) attacks by reading the PHPKITSID parameter from the HTTP Referer and using it in a request to (1) modify the user profile via upload_files/include.php or (2) create a new administrator via upload_files/pk/include.php.


tnftpd before 20080929 splits large command strings into multiple commands which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unknown vectors probably involving a crafted ftp:// link to a tnftpd server.


Multiple cross-site request forgery (CSRF) vulnerabilities in WS-Proxy in Eye-Fi 1.1.2 allow remote attackers to hijack the authentication of users for requests that modify configuration via a SOAPAction parameter of (1) urn:SetOptions for autostart (2) urn:SetDesktopSync for file upload or (3) urn:SetFolderConfig for file download location or modification of authentication credentials; and (4) urn:AddNetwork for adding an arbitrary Service Set Identifier (SSID) to hijack the image upload.


Cross-site request forgery (CSRF) vulnerability in page 34 in MODx CMS 0.9.6.1 and 0.9.6.1p1 allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. NOTE: due to the lack of details it is not clear whether this is related to CVE-2008-5941.


Cross-site

request

forgery

(CSRF)

vulnerability

in

in

MOStlyCE

before

as

used

in

Mambo

and

earlier

allows

remote

attackers

to

hijack

the

authentication

of

administrators

for

requests

that

add

new

administrator

accounts

via

the

save

task

in

a

action

as

demonstrated

using

a

separate

XSS

vulnerability

in


MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts (2) split and (3) deleteposts actions which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header.


Cross-site request forgery in cp06_wifi_m_nocifr.cgi in the administrator panel in TELECOM ITALIA Alice Gate2 Plus Wi-Fi allows remote attackers to hijack the authentication of administrators for requests that disable Wi-Fi encryption via certain values for the wlChannel and wlRadioEnable parameters.


Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the \Creating a Database\ functionality (db_create.php) and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set.


Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors related to improper token validation for (1) cached forms and (2) forms with AHAH elements.


Multiple cross-site request forgery (CSRF) vulnerabilities in Blackboard Academic Suite 8.0.260.7 allow remote attackers to hijack the authentication of student users for requests that change configuration and enrollments via unspecified input to (1) update_module.jsp (2) enroll_course.pl and (3) unenroll.jsp.


Cross-site request forgery (CSRF) vulnerability in Blogn (BURO GUN) 1.9.7 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make content modifications. NOTE: some of these details are obtained from third party information.


Multiple cross-site request forgery (CSRF) vulnerabilities in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag LacoodaST 2.1.3 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (a) change passwords or (b) change configurations.


The administration application in Django 0.91 0.95 and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.


Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote attackers to perform unauthorized actions as cPanel administrators via requests to cpanel/whm/webmail and other unspecified vectors.


Cross-site request forgery (CSRF) vulnerability in admin.php in eTicket 1.5.5.2 allows remote attackers to change the administrative password and possibly perform other administrative tasks. NOTE: either the old password must be known or the attacker must leverage a separate SQL injection vulnerability.


Multiple cross-site request forgery (CSRF) vulnerabilities in MyBB 1.2.11 and earlier allow remote attackers to (1) hijack the authentication of moderators or administrators for requests that delete threads via a do_multideletethreads action to moderation.php and (2) hijack the authentication of arbitrary users for requests that delete private messages (PM) via a delete action to private.php.


The point moderation form in the Userpoints 4.7.x before 4.7.x-2.3 5.x-2 before 5.x-2.16 and 5.x-3 before 5.x-3.3 module for Drupal does not follow Drupal's Forms API submission model which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and manipulate points.


Multiple cross-site request forgery (CSRF) vulnerabilities in BugTracker.NET before 2.7.2 allow remote attackers to delete arbitrary bugs and perform other administrative tasks via unspecified vectors possibly related to delete_*.aspx pages and massedit.aspx subscribe.aspx flag.aspx and relationships.aspx.


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

wp-contact-form/options-contactform.php

in

the

WP-ContactForm

alpha

and

earlier

plugin

for

WordPress

allow

remote

attackers

to

perform

actions

as

administrators

via

the

or

parameter

to

wp-admin/admin.php.


Multiple cross-site request forgery (CSRF) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) mcsp_opt_msg_no_answer or (2) mcsp_opt_msg_wrong_answer parameter to wp-admin/options-general.php.


The editor deletion form in BUEditor 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.1 a module for Drupal does not follow Drupal's Forms API submission model which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete custom editor interfaces.


Cross-site request forgery (CSRF) vulnerability in deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for WordPress allows remote attackers to modify the oldstructure (aka dean_pm_configoldstructure) configuration setting as administrators via the old_struct parameter in a deans_permalinks_migration.php action to wp-admin/options-general.php as demonstrated by placing an XSS sequence in this setting.


Cross-site request forgery (CSRF) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to perform unspecified actions as unspecified authenticated users via the User-Agent HTTP header which is used when composing Forgot Password e-mail messages in HTML format.


Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 when generating the HTTP Referer header does not list the entire URL when it contains Basic Authentication credentials without a username which makes it easier for remote attackers to bypass application protection mechanisms that rely on Referer headers such as with some Cross-Site Request Forgery (CSRF) mechanisms.


phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.


Multiple cross-site request forgery (CSRF) vulnerabilities on the Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware allow remote attackers to (1) make the admin web server available on the Internet (WAN) interface via the WWWAccessInterface parameter to Forms/RemMagWWW_1 or (2) change the IP whitelisting timeout via the StdioTimout parameter to Forms/rpSysAdmin_1.


Interaction error between Adobe Flash and multiple Universal Plug and Play (UPnP) services allow remote attackers to perform Cross-Site Request Forgery (CSRF) style attacks by using the Flash navigateToURL function to send a SOAP message to a UPnP control point as demonstrated by changing the primary DNS server.


Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user as demonstrated by inserting an address-book entry containing an XSS sequence.


Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons (2) start daemons (3) add shares (4) remove shares (5) add printers (6) remove printers (7) add user accounts or (8) remove user accounts as demonstrated by certain start stop and restart parameters to the status program.


Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page a different issue than CVE-2010-4555.


A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for sensitive transactions in the administrator functions.